<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="54712">
<package pkgid="60962e5dcc6e7edf4187dd5aa8db97fb070d97c9dd6ee10f21b8ea7b782fe8eb" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="66f2e0ae0978ab9aff04ccfe89c0b39c86aad2af874924f14718fe0fd5462361" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="871f069ce9d19a7ef549fdd663dd251e1cb0894ca7dd8556c166e89241c0a986" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d9b216d9738b662d40cec6f4636c4e59ac9aa6dabba2563bdf4102972c82a2b9" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="c09300a02834293cbb314212a5128ddccf9710e6473ce849f4b50834c72ce1ca" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="39e5514280088eb6c48ffcae2febcb4917aba329f553b5d0220274af07e1372f" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="65c3bc78714ee0c888f8c0b4474d88219ca0f91d221f98831a107d06c37288eb" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="d84a0d44a29c35a8f7760202400199574529d2005fb6d79fd0254558a0bd4582" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8ddaf45babed9b1081a6add1208ef4e266e6c5b14a313f56bcfa56a92e216a00" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="212a4be3d5235966b00b7c4a1c79adf64214bf38f8d898900604ce473d34903d" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f1682b8fb728a90620033925d4333bb3a803190afcd330352b0f755416c2c215" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="dec209b5fb0e2c8ae1423c01820895a0194b53ab130a6147a2440d236e420594" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="02cd746438f78cfc32e1a9c80e523495e1eed724520fdad11aa9efebb3394b63" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="af8bf15c173353eafd29210613d10c2b7522163be179dd67657e309f0ce0363b" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="c292ea730e6a671dbec3e1ca0339340f1d7709ecb6b3bd9acb7bdaee7427f1e7" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="1dd9b4e1e3704bc6499ae7681ecfabfe46edce01a9f6b80ff3f6848ede7f2dd9" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="f8b10405a03c4c1177f9791017d9582c2e5c1f7da3effce2a1e2fbbc73e6270f" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b129859e7252e4341185e260764ca2e78cbc6a5adf52a7eb7684046bc9115727" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="ac938da1ecea750c7ad52ca03a355b41e37612264770cf3a7ca9e81b0b2a4ff9" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="15bbf9f4cdbd0f9b36071bb99e80a0835f6e98b02587f9de70b8d9f4bfb5e210" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="0368f349fe8e816b17ff6acc7b23d1dc1005654a7b30d0e1d70c8df8b381a614" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="74ab063994a334c92a80c7a9dfbfcc56824a20e07324e72a6a8749b27186ab35" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="10d9e56cef39561bc571393719dcc20e00dff6816ac281ddaccbf6450813fc90" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="438c7f3afee143fced09d054c2e05319ea90dd682d6bb3b3881fd20180eb4784" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7b8236668af17a24a911b74a12789bacc4ddf32b8fb2abeb481759ef0a4505f9" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="02edeef35ba74870cf5b27ab23ade7c77cd665384cc833a2c86ee65ca00fdf80" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="4cd6c8fe39bf555285b636db615a5decddcb9b8a17b5f5c5047fe498b88a523e" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="581799be927b825ba2119629b89dcfe20f162e2f8415e6a5bc53f69d2fa573c4" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="42c83ba1bf562eedc13c641784480405cca2ee42f71c4520d4976bb8b02871f5" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8776fdf4c890bd192f40d1853db3dc2fb3a4520dff8c5d534b40948e4e76e92b" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="1dd16a6b3e2a1223f6b63936d8b93fa15b9ed04daeff18eb4061d58f292f945d" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="33499cf7788d41d903c025c63295ccc71ef4ed6119977ba01d956cecfe488bc2" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="5b09439c26d50c365715b2c9ba7ba2265b53d0cfcb904742739f9f0fb44ee448" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="abb03a4039f3b485c0e75d38e4593923790e247d1d6537454c0ceee378fbc7ef" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="9156e5b3b99139aeedcfb9fd0fc147db1eea9e052b57e1368a4ea58afdf5ba58" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="42c77af7b1c6418861af5b0075e3a35668e561b539d51075787a9b5984414a7e" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="4cd45035bf088f265cb73f962f50252c1f9bac1b5f9d90eecf4ea46b680f8de4" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="949f4a2646b881565321f04993767940638f0f07d08783c4c6f8f1f0ff41d47e" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="fcfa006d74e1a766c2a54a0bf60a73fc734d3d8490e33f8eed7d53ae3e338ba2" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="1e9a4010f75af44400639d224f575c6ac87c0c2445056ee1b0e0e7aee64cd526" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b5a2600a6223acaaec3834b0e991c391c5d43e4238b5d79655be2f0dfc4812e2" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b036e38d8fef144bfc9d31f87f9e334e100dd3d57cded5c344140857d68dc697" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7f9d66e0388c5523d9c9a9ad6b94b73d5e2265da179c9fd3182b1f4d1ba3be77" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f2fae075c0d6670eca4273f298d64da145f872b3204c85884bb3c76312f21b44" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="fadd3fca1038747162f001095b1935d6c0eba834f39248e540f8e99f86d221d0" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="738d3c85a90cb15ec1b88913f03ee8877728899b53f48077e569f0cd867009b0" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="284b59baeb1c751221559f019f181dc8957072c3483ad96d70dc53e438db349b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="63ce914683da1dcc7205587e0743a629899faf1b1629527ff836792845548ad6" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8b37581104a94c01f6948c9c9b155054b07b81589d21f1803378b555a167ae1f" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d239408a90ce53f082bbbe21280c375b5158b7e65689b57549490db5d7a1bfd7" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="833db83b48cc0afd6994e59f83b4689a0a3190a6a3776db45bae88361d083884" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f72998045902fe502325a1d75bdefc6fcc17875aeca31fc11f0422e681d1b51b" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b56f5c5b32d23ab31e875502304ae0f12f33ebfd179a399a33e14780da73329a" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="3bd695958e9eecd7b3e51dea3efc12e4de71deb3178a40eeaa9b205249d2730a" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="6870717bdcd7c9d974885ec809fe34b7d74f24dc90d80ede9888d89b451c934d" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="a49631fd5736c24e1b54995b427c99c5f2cf4413173b6df64c5633b169833dbd" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="e8ac1e42c54c6577aeb6a2a552961bc8dba53ff58992fadb4ace7fc8d8943fb9" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="45dbaf728c5c4ef6c9a7fa264272a74a1f51dec2a4bc78c22341387a3890f5ac" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="a09770fe1c4f17cdc5abde1e5c965413ce1f7919356c46ea473df5b7c5fb34eb" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="17bab2b4b3196d62ac6f998633731fccbe2a63be7527c9e27b1899c5281dfcdf" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="d84b7a5f230ac585869c36b3c7c4721516fdbd2fa361e3e255584bcd0a0ad400" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="dac681f057dd17ebe044ffcd71b89b00d6aae6d0a05f118ec21b430d5717b6f8" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="619a7b637daba6d951bf78ef4010f62afa54b930860f2b647586268854e9a60b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="afef0c94fc40cacffd96a9d7bacdfe57bd3c36da4b150855dca82fb6d5dc2bfe" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8a70393192618581a8431af780dff751fa1decc8f9cf8694736b48c64dbe1035" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8af5d5640ffcfb0a5a25f6a196a4dfba6bfd96e0f0d5a9bd67a9d7862f100cb4" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="844cd5941c57aa9e02ae80a689b3da3fd819391c325982a875bf259f15b96014" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="56483be9c92d9a201761067b64a759063ca2cac2795845177210d857d473898f" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c87fba4d4ca1908cafabbe82ca97ff47203db4caa75caeb6f47d3b8048b5081c" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="486c59da5a948c8a04f849c9dcfe1a371dc34eb11286f28c8b7cf17976487e89" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="39b5dd9d30ba78b764d1911e7a39a4fb1451eb9aaf549c5599db3f71f14b6e39" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="68b5eae28c78ea78a5e98aa8c0b8003222323b164943207aaaead222f7d0a5f0" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8edd9cd30f7081586754acc75c0c3ccc68c0679cca479f0defb732d604643b38" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="5dc85a370073237745c76eb90a9b8b7602a0cb5241e97a2841dcf4da2401600a" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="6ce5ed4f24766be45476b31224d8f50953b63e77d5c62528bb0dbfe9b6286339" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="3ca0f12ec52e3b77d75ff9450e997254ecf12c07591b746b35a6c95a43979338" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c74e1f67e22cfbfaad06883c435ae809288a22ea481d88b3e3b48465424c861b" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1dab7a5c1d8bf8b358868199ea92bd9a3ef0bd3b9bd7135b8498e0754caafb0c" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1eec6c4934925982aac38d300b1928fad8b41ede706d4d60f770848230d9c559" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="08abb5a50de17537363a63884e86ebc656693737f6c5d9d4395f48a31ff24acf" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="9790eae5ae81838114105cd059c37ac1d2daafb5e3b9aa85d845295f779f16aa" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="572698d2554f54db6cbdde244d1ebe19c1598f78c7879c600720c4143fd84abf" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="77464805c99e75b65112719043afdd91b13af4f04abd83094e0ceca75bcca09f" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="a71e291ba9d88334d227200b82d0f3394ca97649990ca9d1bb12cfaa74505733" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7d347b83f06b1d2878f88b0b0421241b2bb39974ba612980340fc605494818bd" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="b87a854547a763e0627c5a9b7ca9a0f49b5ee6a18ace8485d6b26ae3d06c1f2a" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a0ca292998fba1953af0262fb1ce988222b3382bf0d3aeaa49bdf7a7a9bd907b" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="297aba2c01f47a35604c1f347fc105fb858a7f636da9cf422ea75b321ebd99a7" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="fa9c5cca62642398136ccbed7a213eb3d101aeaf33f516d010b654559dc46506" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8c5962ffe0dab67b15d76d10ceddc7e925745a5de52b66e7affcf2ae1bd0ae90" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8f32ebd7c5c5344ecb4b53a7eef7bf0ec8936548648a7257e10f541ac4f430a2" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="a3c54ce3fafe5c84d1ac25c132a5775b086d5e193f844036fbe3564ca3388db9" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="f10d140fbf270939bfec37db2a1ccdfa38e1ca26a84afd97a18e961c84c2b373" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="ea8fd0f11727d1717a58d8497dba728a033cb3de4d83e03ebd12fc72b0ba4c27" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="df10814e4d7d96ec7dbf2abdc2e1ed0ea3889f2759f48734562de556735f905d" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="68660614004b0c8516b6305ece3fb7d179d4e7a61458c4cd2773462fde9d7228" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="d8e20d886ba80b4e7faf12259a806d983cea65883ba9353cf916f0359ea4fc59" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="e68b5aa967a6c143ca221840999b84b12b29bed60a70aa4ae3c55cfe69426d29" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8b3bf80f40354fb9d9c18e77943c7055c7b8ca1aed1191fbd9ef5516ec234243" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8716d445b995cf077b200aa9f0248da784d9e243628a26914922e56d327f9708" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="449fe7d54592df27b7d85d59efa3b28e09e8694a2716ae28c2424439b6f5308d" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="7b9d7484c1cb1e4a3923bc6c67bc406ff623ddc7ec4b9f718807221725f14474" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="92fa212d68eb16fd864208de6349afc178f22b8dd4de75810de3f485e4819fcc" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="9738e5f190424f915fecc8761c27ecd8a4fbbbd03ab0613698e6fe25c3a9c306" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="39c4aa22eb6ed9a5a49ed9126bffcc27892adc910aff59738fcfba92b7046204" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="64b96cd71b556830a7c4a3883260d2b3e8165a95fed6b7c74b77875e9d208778" name="FastCGI" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="88d2dac9dfc3e05a4c02d370e130eeea0e41edea1af0662d6528011a7d73c1cc" name="FastCGI" arch="ppc64le">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="e39c81acf43ab4f7ea2ff02c1c71266587d2acb1054203b5b4be2ea868d841f8" name="FastCGI" arch="s390x">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="58926c68542712c3e00e18512d356618213a518da1153ce36a89ff4cebbac0ec" name="FastCGI" arch="src">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="mrueckert@suse.de" date="1157716800">- add README.supervise
- small spec file cleanup</changelog>
  <changelog author="mrueckert@suse.de" date="1158321600">- add perl_make_install for all distros other than suse.</changelog>
  <changelog author="mrueckert@suse.de" date="1161345600">- remove perl_make_install for now ... i wont build for fedora
  any time soon.</changelog>
  <changelog author="coolo@suse.de" date="1234785600">- fix build with gcc 4.4</changelog>
  <changelog author="crrodriguez@suse.de" date="1246017600">- disable static libraries</changelog>
  <changelog author="mrueckert@suse.de" date="1253188800">- add fastcgi-2.4.0_missing_call_to_fclose.patch (bnc#525009)</changelog>
  <changelog author="jengelh@medozas.de" date="1261310400">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1291636800">- fix build for factory</changelog>
  <changelog author="idonmez@novell.com" date="1306411200">- Add FastCGI-perl514.patch: fix compilation with Perl 5.14</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Enable parallel build</changelog>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="ffc3ce273034256638049d1f3429e4083eea187de95e9b6c4e4ab3aca68cadae" name="FastCGI" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="0943d73f860940a4107647b2ff2f1783dfc79ef3c77f9a2ce03688519edb9ada" name="FastCGI-devel" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="63e05d20b0f11bf7059c458bb984f02f11940755826b220a076b58209ee01b89" name="FastCGI-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="b84ddf4e342d856ab1c6c45737a99c84d74c9c4489a1afa72a3e3c35d47661be" name="FastCGI-devel" arch="s390x">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="a9fe25ecb0693464ef5908ab01f40069340996daefaefd077e43c233236afb09" name="FastCGI-devel" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="e0212b2db6e13c07f7b81540dca77b60400f06c247cb32b2d3cf5486c179f5b5" name="GraphicsMagick" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="aee37979cf1b8ddd752f059d7414194e46c808020a4aa0e55b28ca34fa48ce6a" name="GraphicsMagick" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="88da728c8aec3cdea5ac936759b6b1c6668866e922493e5fe21f31a4b48bf29f" name="GraphicsMagick" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="7d0602d94f3cbce7b3d690c04ede6b7df912f7b5e807d8dba943a536489aa8a8" name="GraphicsMagick" arch="src">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="afac4a952ac3217dcc0cefeb64bf42c72146f359a58b5bd6c6efabc7af77f2bd" name="GraphicsMagick" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="9906595bea3280e16d9e2293e32c9db5e0c0933e40a4ec98111b21fff27fc92c" name="GraphicsMagick" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="2983f28e51feffb974a2796968012632cb2c6227db6e0a73ea6fa19ef7a2d09b" name="GraphicsMagick" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="1a2a76fc1f8002af4007151ffef383874ebd14f40b1d94de06cac9d9e6d0ea79" name="GraphicsMagick" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="cf94c231d474bf783c23b45dd7e2e50c4b1a44d630498b8d62e9d9ca7875d350" name="GraphicsMagick" arch="src">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="f0aaf71645f09957e2f190e75e6f07274f32fca8d674401877c3f06a3ed8c914" name="GraphicsMagick" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="261a530a94bc1e1bd255d2101a465f27bdf4151f37c12c4d054043e6609b87e4" name="GraphicsMagick-devel" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="77be54c7f6b05faf168d0a8876f089bec2bab90ae4e5bdda4e01e98ad0b0894a" name="GraphicsMagick-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="d0db3124b551b4d33672724344968381acea2a705e45f1e44b1f6f1f138f95cb" name="GraphicsMagick-devel" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="b30f858d01642025d6383a706a42ab2090c15f28804d318c18ef720caf774258" name="GraphicsMagick-devel" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="2ac25c14b7bcce2fe5acc0a47120cfb1cbd578afc12e784872575580b1e8b7f7" name="GraphicsMagick-devel" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="f93fab9bc5bfe68118111106352cb29b16b5f4da1adaf5d5e7040d3c1e9d767d" name="GraphicsMagick-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="3aafba55bd5c0b048fb816cca3df6dc11ac98f9e0572567f37127dd4d0a30280" name="GraphicsMagick-devel" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="20ffc11fe75dce4a2160bc8a62a47cbe2e54d315c16b1c3d5697e54ab8fa35bd" name="GraphicsMagick-devel" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="4ec1b7e5699edada116dd86a29ef259af87a3549a54f45b3ef1e9c3c3e9e7496" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="3124d1c12cf143854d6db0898adc34963e4c35a6cfbb5ce856a2b8712c79f16c" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="f360b39c7fb21d341ae2eaff5b04f11d30e0ad971505cbfae26eab532e8213d5" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="dc9a15c71a90d0666d09766034e3b2fb0ac7ef144ac088f7c2b2b37169eecdd9" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="8b53ff293f23bcf3fbb1bed0f5435c971b581b964ee571c4ffbeb7fab48d7f4b" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="58763b5397666c5ab986d7c13f57f971e2129d71c08c52ac07580b9e1cc57088" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="ea55a224f3c6415c21584b2ad647e5e2970b67852d19b6050042f48628a9e935" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="91ca21130db29d0bae8cfefe808c047c7dbb82b87eb93f16bde1fe3380c986c9" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="4014caabc8dd196e703f2ebae4f27a9f86cda525957f23d773db031477c90357" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="2dd5b24023ffbe450f71b37f9a4a74abbd5c58946ec1192158feee709dea24c7" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="f0c20c7bc1540c61380171d068dc38ea7737ed7f3caf4c8555837b40c793547a" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="ebcda2ba9da2c6a27b924b8fbce1ac8c8966a6d34db10e58f1bae373c89d10c8" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="74a754581804f5565853c99e32c2b4f087e81db7e633bff8d3db50f84271f429" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="bd6f4e0617a5677ecd800bad36ec5adeb12146a27c5db9e7910825a8fa513382" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="e7505381ba9c371a0716ed31054d5e0115c938d96a4b940c8336a05a38a1a770" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="f86eeb98b7f03274e25ae04f01ffb86794f57d4dea3909c55673a155d06862df" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="55ddea27637f12608dee80e47f64cf43190a469f5c160dfe5d90ef00e5295eb1" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="b7e07fa88715fecf6e84f9f57b8997410dc64f62564191b66d32a4bb71df8707" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="25b9c3aa5db4761d68da53e99fe45d1d53458516009608975c08ff4c65d349be" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="ecd161e1903867b48cc1165a31e011c641a749dca73bebe1cca7f364d79fbde1" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="c797fdd943294b93757108a206102d89890fd2d0e5fa3a063af98f814735a684" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="8653a3a9c76f414750fadc74e331488916f9931e0b3cab31ac9a430ac64528f2" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="21878acdb06aa41f81f5c4d7942f2df96b944259b16d1c2a5f9c66deae630b77" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="d155e3e5a59a52c45c92309916d1f2f668221c7761da22a8b688314228ad2e4c" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="bb3d3a99c3680de7b3826a0bb2726412228a9485d380ea5d3104efcb3dc7f3fa" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="c9eb8376e6ebd29f734aa83d9f7375d54122fb7a7677e461e6db536f01feea7b" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="fc5364130242dc145aafbd9c6986d90018f9b43b0f2d7c6187b5e724b5dfc516" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="f3347dcf40f49b80fda53a55f6f422bc0cf977289cf192cad3847a927207b6ea" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="3d16952a9dbb16c8537bd6a6e96052f3873af011a28d2a7f5a41e5720251d173" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="897339ed5f885de1ab188560db57813a40cb5d3df86d9caf807ded20a7549576" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="5fb8cdbde4480833c3f60ec63e119d487d274c57cd38b3ce1d32ab4ec896df1c" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="350a092a82d03653ff459a0324bb24ac5e40e265749bfb018f167c6cbdc9ab38" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="e7950e60d58571a30b9b8c5f0652748185567a85ea9c7d0810f42016853f3469" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="5aec2ced691bcee5dd3160d11f1bbac1224a754f56cf0853758905510a83309e" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="896821e18540e1cc8ca3539d6615743ae7a6bc64d897016676ad73d16265274c" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="a1f0f37aa178db2ddb279644e281d04a58d935f3a78b4de62fb4aec0e121aeef" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="1b2365021e00cd2a738de42e383ba4fd1980c937f8c733d7fabe080694fa75f8" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="6a0c714cbc263a910e0c431ae68977f64c8c8137890de57e0bd0990f4bf62441" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="7cc3a611bd55e6d12c660d7ab863c49234c1da8a97c51ae432538036813cdb85" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="682084814a25d499cec9b7b10adebd50f4f08a3c5dd553d8eacbe963d6238cfc" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="1e0515fffa2153d52178d48a736b16bb079f5a56c9cb3ab2d38239359357e389" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="d73fc174c84b29ddfc050b3cb85c17a47ecd102106928d79eb2d639c37eb8395" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="c78a4c3abdb724994484bbb8500149e59ff1cd91e198142f9610bbb4c4eaa77b" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="73347b806dc5f2aa1c1839ce72fb47a1ef0461a2ff24f0278f28b7534dcc0674" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="ce75d1eb2e2ec9a9d4027325fbfac39a49d953c9a584f1c03e996649d2c1f5ad" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="86ecba5e1994ae5be4bb3df3b3b38a7c20dcaf13b03f19a022a8fa103fa4f6c0" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="3fccf3222d91ee9e4f36a6901647c5befa8d6946989dc6ce3eef34fe926507d9" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="dc7c6c98a9492ef741560ec920e4590fd738a5ef6ee5edd6f1c6c9af3a18f13d" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="471bf3f89234ee3bad0f91248f0c80e2018fca7262513af5d06a718fd5f33064" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="9db9afe7cfbf3eec3b0cc9f96da8b4e90982231c5de0c3d00494c7f02228977e" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="04393ac30361bac9a39104938fcc47655a6617eb18c2c7d6877288bf587e331f" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="882c05e02c4ce21397e9806af8a5a7d0a553187f79d8a7ef1b821356b9a57223" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="becd84dd2ac2e58d7e42fdb109220fcb983da29fa4743b8dee9bb374444d20f1" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="a9890d22648b8c58da5f0bb9b6e92da64e4b8a6489a1844c063e0848a062aba1" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="6369a046e0add8ea0ebc0eb5fda553bd025416be721b08b7ca512d5534effb97" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="7863833d198a3b90a4ecc3f579a945a59f6f19ecdaae65dbd9b609838d7932d1" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="4e33559949c20072229b4bae87548ca4cea9cbef60a2a010fa60c6e5fe63813c" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="0174007bae9373c2bb0b0b0f688cce9c4d41fa38c1d2be3c7cb9b170208c6da4" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="956a46af8bdeb3bf93f98e002de432a2658e697093006a8aebd096c4a5de2630" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="898a81681407fab064dda18425a027e371c631c82c2b0fcca78ecff13cd85739" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="abb93ff81a5b14e9381006e795129d3881b86e3268d0d2d03843bf8606d80277" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="ebdce976914b660dee1a5951baa60a6f5149eee7b3d3bd870f0ecee4bb600a93" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="fce6a1f2330638012b8b611be2f959806225ae30d51bb0da00442924cc65164d" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="7162d2087cb4c937d5ea746c36ad97bdbca7aaabe8dcc5f220a2ea19348420ee" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="6ff5457dbf0eb651fc048a646a86f2ec35d96016d069eab29f8fdc6f4d68bd2a" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="429eedf11155a7cce4c4601dc4e293da2ece80908a0066ef706528ad7ff40582" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="5380d94b5740eb9a1dee296d4d1ec037291ca5808aeacb1946f2eec311ce13da" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="601a4d327b4efca7da7aeaa175995e9f3ba5e442093a0ac79039e2b0838aeef5" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="2ffeffd8686b422fee9cf6e5bc24c472175f5bd80e60cd76b8d87262e66d5574" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="be9b9e85e311492b8855fb97a212928d20d7b7eabc573a094f2c6d55c1a3ff25" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="3be08a30a20dc3b936fc14f198f7f9357ce9bb3cd40e790a031af412f3d49d99" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="7085ed5126ba7bc9671e9f993849b372726e62a2b0c50bd7a1c5522cf7241042" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="843dcf5d9a05564768544e3b2c84680cb6e679e913fb93bf324e4269f83a1690" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="2124e12c3c84d5a0716667a7dfeef84c3e1201b07f0c114ac4b9377df471c14f" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="543d8f890fa4714f7b80456c2b0391d33c964fb8c2087b471ce97bf7c88e65bd" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="9cfe1d628c68ecfe5588d2227fc76c334f3bc3ced13c4fad6f64d2bd493c0f8d" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="491481cc9b94a8c8c5da9a07b55e6dc9687ba09214601dccdfb4bf3743eab54d" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="7164959c810761870c67c54dec2f944767c499534a235787da5b34a1c1fc3b24" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="54685242099be5aa07b9ed594a7522b6c66477d1f1b8b6bc6c452fd41e67b58a" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="773a7fc215a3a8c2d25084e30ad802650fc05c21e4a82141efcef6219051e432" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="cfe28b7b281d9aabd34236dadde05064ea0a4818f73d000198de4ef3dd7ee101" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="4a0d8ea2f8b98a6ebf7740d64830e1ee47fc2806ca2710f7b234c1a24cb8ad47" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="df7501989823399050764db44e64b1841fb5192ec5ead27af071a80362232541" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="042b6d7405c35dc20a1d7f6c9d9ac81d8e619f86574e06cdd9b17c041e80c142" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="051941550283a7ec3c7fdc013aff9024cfdead39c2206a9cf7d414da50662abf" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="331ad5b8a9cb9cd908e497035068ea50243bb9f48c89af20bf5309ce8d32747f" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="e881ea834d421d6bcf6435528971b13c145e3e85c75cd2b240cbeca93e16a29e" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="798c14e1ada7cb0e574339a0160aa0db038a408d0fab298a1689aaa468a3362c" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="56d3d399a3410f927bbf8eba766961420faf6e5489e61ade390178708985db19" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="2d62eeb48dc898800691cf57c2f3d5a30fb73f6cebb8ab6d4e9ed64c53b3106f" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="db5e75621f3b25d284bd97e660b59098c3b41314c616c0b7acf30e1d158eb2e8" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="e63bfb46204f7ca6c5e9b6bb987ed2bd374e77ad6b4e9838fa9766b2d5b848a0" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="5d99cd758a74d94e306f53779987be065b724ec34f1016d4bfa1a73152270210" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="0860841adcb27dbee4e6505ea7fd235199044c625867f84194708b1e45e41460" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="a6aba2729a617f8c256741bafa3cc46fb6671b4ac0073df38ede61437ccfffc8" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="5577188b62b56f562ec6a12c17a857b90652f3ee65ebd0f73006dceecb0ff6bb" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="5f817e301b0c271959ded97d9105f2627d0752c62f2977c74fae70b59a27e6a2" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="5bf38de39e35f1d58528629f7a2f4f39341b36e1f10bf72e52a3abd4e004ea11" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="55e0fcb52cd4d19f27262e82c1b17d359ee19650531bdc7339366773609028a4" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="e378a34b25e19f525ca59e0df9a51b054e4dae4c8762470d0f034c093fba0cec" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="50e3711f14dd2759ba083ae558f41f135f7383e97bdedaad1340fd0421e8f20b" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="f8705d482cf83c4aa5eec806441353d6390f35cec199fc03a5c0b82bbf0e62d5" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="8951ec59847eaa1af821634bed0d0ff4b59f2b9068dd0db329cd1985fd6e7556" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="567ba43fbfc047dbeac27af79a892f6e4a4cbaebfad382423da61e3586560e86" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="a9d4815c77a68ed080f0234c663e2792069be3ec3e668fce64eaea418b8849f5" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="dbd9f586c284e0316a74ecdc8936e64f40dd183f60769b53b0536b1599ed6231" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="b8a83fc9dc48f3713a2740195d8e66fdb577f29b10a4c8e588404d618f848a7a" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="47d1b1993c861b59a4e6e433a475d1183fa42d172d0228b8e2bf89488aee0403" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="e687f108b9b086ffabe7aa03e35217105cf76ef3e0d908846c59862cd9337147" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="861dad0a73b4b335f9843153b45372326a3522d5f71109fc11f240787f063b48" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="0bead6bb642d7500f170637c8b789349f3cf8113a6dc022784f9f1eebd7a1482" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="da9491bff4e6b18dd623ff4b12cb8cd11f80d23f980eee8ee82edd63e1a1fb2c" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="9dfa813bc5d755c12bb963f77f82a879519a2a19f337427573c678dd38b66c78" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="ec8646b3b919add82dada5e331adb7061c64d9b3222dc911940f564dfc44216e" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="a329c5ca1f54bc5bbc172ead6ced13dc5b3b25cf0fb793bdc41a1904b7cc26ed" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="041e6e330b2d1d440560a206c102dca23881e7952af0f1455f4e0cb547192957" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="92a45daf236293ddd1ee77da705017f9e06f56ff9307466141914059f8893664" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="89fac384aefa9ba696c7b1cbdc563dec8eb8d95d7be9fdb25333aaabc35bbb83" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="646af0a65ba1f97ed82ce1eda40bfbc332266b392db84995b734030cce214520" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="f774a7afa1bb79fffdd8b8f54672bac38160ad8f9b29de74534a271c883a87a7" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="5b1501e5987acc077a00578f8db9b1ef4de81a6639f8bee3f0b913d995d80b3e" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="86a6227ac4aaee338005682f9ac47bed1dd9f1f4d74c148e175170c7a9dc9d71" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="afb416d5068b02656d34e9a847bd80ef3b5c2bdfe3c7cf29ac1a0ead09a0e155" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="c62400f0ef18750b8e696ac6431348dd18db5ce9e219e691701c2670eb1d1c1b" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="6b2a18b0c7e7d8c0bef96f77175e947044b783e0e1e1a4930cb2a2c931faf05b" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="00e29c21d2b97ec3762b9539a375186b999cd2a694921423dc85e3d70b23e508" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="86bdfeb6c6993ff631e7bba04afecc3e6287ad2041af628dffccebce585e3b05" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="e8fca1762ce6d988573fc256611e5f1382535d96c1567419916f25ccb49f0f14" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="403d383165fadd54eda09fe50459f2d233f30804dc6dcb07b187fbf938586895" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="0e791f9ffb3427bb6e981e50e73768b2a3823e401a34b2df173374580d6e8a16" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="5ecdceeab3531b8468cd3827cce8eeac8382c85744a68940435465f29b82729c" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="d915ae0040261f4de3a39ed7d5d805c6d8d8bee889fccdedd4d4607e0d0e4c05" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="cbc2533ffbfecd4e92524f9a5e3d18f567723b0dd9cdfa0b219658c628140f4d" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="5f8447082fcd595c4e1f62a7fc1617a620cc379c9b7a93e4a442c30e35ce0c68" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.13.1"/>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
</package>
<package pkgid="63404fe2ed42d410221481232ba1ce5690b27e57c230fcb8fd7753883eebd9e2" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="0cad517c2c37b78c5f209897ddedbe27ecf975b6d89ee85b72cfaa1d74f9c86e" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="f0fac16f3839597d237c34ec7b08944c903b0bce79205f0c37f262ddb1a06e0a" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="0eccb557f562aa7120af98f7c6bd8d273dac934b17512def3b1c31a0222e052e" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.20.1"/>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="opensuse@dstoecker.de" date="1751976000">- change policies (allow ImageMagick to read it's own files again), see boo#1246065
  adapt ImageMagick-configuration-SUSE.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1752667200">- security update
- added patches
  CVE-2025-53014 [bsc#1246530], an off-by-one error may cause an out-of-bounds memory access
  + ImageMagick-CVE-2025-53014.patch
  CVE-2025-53015 [bsc#1246531], specific XMP file conversion may cause an infinite loop
  + ImageMagick-CVE-2025-53015.patch
  CVE-2025-53019 [bsc#1246534], format specifiers in a filename template may cause a memory leak
  + ImageMagick-CVE-2025-53019.patch
  CVE-2025-53101 [bsc#1246529], input manipulation may lead to an out-of-bound write
  + ImageMagick-CVE-2025-53101.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1754395200">- added patches
  bsc#1247475 (https://github.com/ImageMagick/ImageMagick/issues/8261)
  + ImageMagick-filename-placeholder-regression-1.patch
  + ImageMagick-filename-placeholder-regression-2.patch
  + ImageMagick-filename-placeholder-regression-3.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1755691200">- security update
- added patches
  CVE-2025-55004 [bsc#1248076], heap buffer over-read in in ReadOneMNGIMage when processing images with separate alpha channels
  + ImageMagick-CVE-2025-55004.patch
  CVE-2025-55005 [bsc#1248077], heap buffer overflow when transforming from Log to sRGB colorspaces
  + ImageMagick-CVE-2025-55005.patch
  CVE-2025-55154 [bsc#1248078], integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write
  + ImageMagick-CVE-2025-55154.patch
  CVE-2025-55160 [bsc#1248079], undefined behavior due to function-type-mismatch in CloneSplayTree
  + ImageMagick-CVE-2025-55160.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1756468800">- security update
- added patches
  CVE-2025-55298 [bsc#1248780], format string bug vulnerability can lead to heap overflow
  + ImageMagick-CVE-2025-55298.patch
  CVE-2025-57803 [bsc#1248784], 32-bit integer overflow can lead to heap out-of-bounds (OOB) write
  + ImageMagick-CVE-2025-57803.patch
  CVE-2025-55212 [bsc#1248767], division-by-zero in ThumbnailImage() when passing a geometry string containing only a colon to `montage -geometry`
  + ImageMagick-CVE-2025-55212.patch</changelog>
</package>
<package pkgid="6cfe3cbc310fce3628d5bc66358210bd94dd1aa2e3a7a50ed6e5f7e6f1f4feec" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="68ab3676b076328e5bf39236f0a6135b83938f276f1f1257cfb75f7c012ed988" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="35f0dcfa6ef4ddeca1f63473501af11e457b9e43b93b6389dc8031f48b6280b5" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="2c6b111aa7d8331ab36fbfcef18e329c234a30e1a3f34fdff26acef21ce78a0d" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="c45c6c2888d116eebee26c732d4ad20b7ce828f5b9379200f3355a910b8405e8" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="58ae7b2033dd3ad5b11ba532a4d265a191349c547c9a625e5e2a711b182241aa" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="f21926664b47daf998c701865bcd2ca3e46b25f04247add173b2e825944266ce" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="88d2536dc2ac1f108ccf7345c4cba46c445fea9b554f3a2e69074c44a871f868" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="8c8f32dca47d879e4aedde5acef4eced127ee5ddce74b59a9b118e5c6c4b04ca" name="LibVNCServer" arch="src">
  <version epoch="0" ver="0.9.14" rel="150600.3.3.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- Update to version 0.9.11
    Overall changes:
    LibVNCServer/LibVNCClient development now uses continous intregration,
    provided by TravisCI.
    LibVNCClient:
    Now initializes libgcrypt before use if the application did not do it.
    Fixes a crash when connection to Mac hosts
    (#45).
    Various fixes that result in more stable handling of malicious or broken
    servers.
    Removed broken and unmaintained H264 decoding.
    Some documentation fixes.
    Added hooks to WriteToTLS() for optional protection by mutex.
    LibVNCServer:
    Stability fixes for the WebSocket implementation.
    Replaced SHA1 implementation with the one from RFC 6234.
    The built-in HTTP server does not allow directory traversals anymore.
    The built-in HTTP now sends correct MIME types for CSS and SVG.
    Added support for systemd socket activation.
    Made it possible to get autoPort behavior with either ipv4 or ipv6
    disabled.
    Fixed starting of an onHold-client in threaded mode.
- dropped patches:
  - libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch (upstreamed)
  - libvncserver-byteswap.patch (stop maintaining not upstreamed patch)
- modified patches:
  % libvncserver-0.9.10-ossl.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1546516801">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1547208000">- Fix devel package dependencies</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- update to version 0.9.12
  - Overall changes:
  * CMake now is the default build system, Autotools were removed.
  * In addition to TravisCI, all commits are now build-tested by AppVeyorCI.
  - LibVNCServer/LibVNCClient:
  * Numerous build fixes for Visual Studio compilers to the extent that
    one can now _build_ the project with these. The needed changes for
    successfully _running_ stuff will be implemented in 0.9.13.
  * Fixed building for Android and added build instructions.
  * Removed the unused PolarSSL wrapper.
  * Updated the bundled noVNC to latest release 1.0.0.
  * Allowed to use global LZO library instead of miniLZO.
  - LibVNCClient:
  * Support for OpenSSL 1.1.x.
  * Support for overriding the default rectangle decode handlers (with
    hardware-accelerated ones for instance) thanks to Balazs Ludmany.
  * vnc2mpg updated.
  * Added support for X509 server certificate verification as part of the
    handshake process thanks to Simon Waterman.
  * Added a TRLE decoder thanks to Wiki Wang.
  * Included Tight decoding optimizations from TurboVNC thanks to DRC.
  * Ported the SDL viewer from SDL 1.2 to SDL 2.0.
  * Numerous security fixes.
  * Added support for custom auth handlers in order to support additional
    security types.
  - LibVNCServer:
  * Websockets rework to remove obsolete code thanks to Andreas Weigel.
  * Ensured compatibility with gtk-vnc 0.7.0+ thanks to Michał Kępień.
  * The built-in webserver now sends correct MIME type for Javascript.
  * Numerous memory management issues fixed.
  * Made the TightVNC-style file transfer more stable.
- removed patches
  - LibVNCServer-CVE-2018-20021.patch (upstreamed)
  - LibVNCServer-CVE-2018-20023.patch (upstreamed)
  - libvncserver-0.9.10-ossl.patch (not upstreamed)
  - LibVNCServer-CVE-2018-15127.patch (upstreamed)
  - LibVNCServer-CVE-2018-6307.patch (upstreamed)
  - LibVNCServer-CVE-2018-20019.patch (upstreamed)
  - LibVNCServer-CVE-2018-7225.patch (upstreamed)
  - LibVNCServer-CVE-2018-20022.patch (upstreamed)
  - libvncserver-0.9.1-multilib.patch (cmake now)
  - LibVNCServer-CVE-2018-15126.patch (upstreamed)
  - LibVNCServer-CVE-2018-20020.patch (upstreamed)
  - LibVNCServer-CVE-2018-20024.patch (upstreamed)
- removed by upstream
  - libvncserver-config
- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549886400">- fix cmake build, add cmake-libdir.patch (upstream issue #281)</changelog>
  <changelog author="pgajdos@suse.com" date="1549886401">- use upstream commit, amend cmake-libdir.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1572868801">- turn the test suite on</changelog>
  <changelog author="fvogt@suse.com" date="1578657600">- Add patches to fix crash on shutdown:
  * avoid-pthread_join-if-backgroundLoop-is-FALSE.patch
  * fix-crash-on-shutdown.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1588593600">- deleted patches
  - LibVNCServer-CVE-2018-20749.patch (mistakenly added, it is
    already part of 0.9.12)</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- version update to 0.9.13 [bsc#1173477]
  [#]# Overall changes:
  * Small tweaks to the CMake build system.
  * The macOS server example was overhauled and is now the most feature-complete sample
    application of the project, ready for real-world use.
  * Lots of documentation updates and markdownifying.
  * The TravisCI continuous integration now also build-checks cross-compilation from
    Linux to Windows.
  * Setup a [Gitter community chat](https://gitter.im/LibVNC/libvncserver) for the project.
  [#]# LibVNCServer/LibVNCClient:
  * Both LibVNCServer and LibVNCClient now support an additional platform, namely
    Microsoft Windows. Building is supported with Visual Studio as well as MingGW.
  * The separate crypto routines used by LibVNCClient and LibVNCServer were refactored
    into an implementation common to both libraries.
  * Several security issues got fixed.
  * The bundled noVNC client is now at version 1.1.0 and included via a git submodule.
  [#]# LibVNCClient:
  * Added connect timeout as well as read timeout support thanks to Tobias Junghans.
  * Both TLS backends now do proper locking of network operations when multi-threaded
    thanks to Gaurav Ujjwal.
  * Fixed regression in Tight/Raw decoding introduced in 0.9.12 thanks to DRC.
  * Fixed encrypted connections to AnonTLS servers when using the OpenSSL back-end.
    Made possible by the profound research done by Gaurav Ujjwal.
  [#]# LibVNCServer:
  * Added a hooking function (`clientFramebufferUpdateRequestHook`) to deliver
    rfbFramebufferUpdateRequest messages from clients to the frame producer
    thanks to Jae Hyun Yoo.
  * Added SetDesktopSize/ExtendedDesktopSize support thanks to Floris Bos.
  * Added multi-threading support for MS Windows.
  * Fixed VNC repeater/proxy functionality that was broken in 0.9.12.
  * Fixed unstable WebSockets connections thanks to Sebastian Kranz.
- deleted patches
  - LibVNCServer-CVE-2019-15681.patch (upstreamed)
  - LibVNCServer-CVE-2019-15690.patch (upstreamed)
  - LibVNCServer-CVE-2019-20788.patch (upstreamed)
  - avoid-pthread_join-if-backgroundLoop-is-FALSE.patch (upstreamed)
  - cmake-libdir.patch (upstreamed)
  - fix-crash-on-shutdown.patch (upstreamed)</changelog>
  <changelog author="fcrozat@suse.com" date="1610107200">- Add many patches needed for GNOME Remote desktop (already in
  Fedora):
  * TLS security type enablement patches gh#LibVNC/libvncserver!234
  - 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch
  - 0002-libvncserver-Add-channel-security-handlers.patch
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch
  * Fix crash on all runs after the first gh#LibVNC/libvncserver!444 rh#1882718
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch
  * Fix another crasher glgo#GNOME/gnome-remote-desktop#45 rh#1882718
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631880000">- purposedly adding just this changelog entry
- previous version updates fixed also:
  * CVE-2020-14398 [bsc#1173880] -- improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  * CVE-2017-18922 [bsc#1173477] -- preauth buffer overwrite
  * CVE-2018-20748 [bsc#1123823] -- libvnc contains multiple heap out-of-bounds writes
  * CVE-2020-25708 [bsc#1178682] -- libvncserver/rfbserver.c has a divide by zero which could result in DoS
  * CVE-2018-21247 [bsc#1173874] -- uninitialized memory contents are vulnerable to Information leak
  * CVE-2018-20750 [bsc#1123832] -- heap out-of-bounds write vulnerability in libvncserver/rfbserver.c
  * CVE-2020-14397 [bsc#1173700] -- NULL pointer dereference in libvncserver/rfbregion.c
  * CVE-2019-20839 [bsc#1173875] -- buffer overflow in ConnectClientToUnixSock()
  * CVE-2020-14401 [bsc#1173694] -- potential integer overflows in libvncserver/scale.c
  * CVE-2020-14400 [bsc#1173691] -- Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  * CVE-2019-20840 [bsc#1173876] -- unaligned accesses in hybiReadAndDecode can lead to denial of service
  * CVE-2020-14399 [bsc#1173743] -- Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  * CVE-2020-14402 [bsc#1173701] -- out-of-bounds access via encodings.
  * CVE-2020-14403 [bsc#1173701]
  * CVE-2020-14404 [bsc#1173701]</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- version update to 0.9.14
  [#]# Overall changes:
  * Added more documentation (build system integration, repeater setup) and a legal FAQ.
  * Added [contribution guidelines](CONTRIBUTING.md).
  * Ported the TravisCI continous integration machinery to GitHub workflows.
  [#]# LibVNCServer/LibVNCClient:
  * Added [qemu extended key event].
  * Fixed several potential multiplication overflows.
  [#]# LibVNCClient:
  * Fixes of several memory leaks and buffer overflows.
  * Added UltraVNC's MSLogonII authentication scheme.
  * Fixed TLS interoperability with GnuTLS servers.
  * Fixed detection of newer UltraVNC and TightVNC servers.
  * Added support for [SetDesktopSize].
  * Added SSH tunneling example using libssh2.
  * Added some extensions to VeNCrypt in order to be compatible with a wider range of servers.
  [#]# LibVNCServer:
  * Fixes to the multi-threaded server implementation which should be a lot more sound now.
  * Fixed TightVNC-filetransfer file upload for 64-bit systems.
  * Fixes of crashes in the zlib compression.
  * Added support for [UTF8 clipboard data].
  * Fixed visual artifacts in framebuffer on ARM platforms.
  * Fixed several WebSockets bugs.
  * Fixed the UltraVNC-style repeater example.
  * Added support for larger framebuffers (two 4k screens possible now).
  * Added support for timeouts for outbound connections (to repeaters for instance).
  * Fixed out-of-bounds memory access in Tight encoding.
- modified patches
  % 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch (refreshed)
  % 0002-libvncserver-Add-channel-security-handlers.patch (refreshed)
- deleted patches
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch (upstreamed)
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch (upstreamed)
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch (upstreamed)
  - LibVNCServer-CVE-2020-29260.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- fix devel package dependencies (by Christophe Marin) [bsc#1247887]</changelog>
</package>
<package pkgid="5be34be26ab228dc1be8032aec71eb8ae3f15df5f2b4b0c5bdff7ed3d486fb59" name="LibVNCServer-devel" arch="aarch64">
  <version epoch="0" ver="0.9.14" rel="150600.3.3.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- Update to version 0.9.11
    Overall changes:
    LibVNCServer/LibVNCClient development now uses continous intregration,
    provided by TravisCI.
    LibVNCClient:
    Now initializes libgcrypt before use if the application did not do it.
    Fixes a crash when connection to Mac hosts
    (#45).
    Various fixes that result in more stable handling of malicious or broken
    servers.
    Removed broken and unmaintained H264 decoding.
    Some documentation fixes.
    Added hooks to WriteToTLS() for optional protection by mutex.
    LibVNCServer:
    Stability fixes for the WebSocket implementation.
    Replaced SHA1 implementation with the one from RFC 6234.
    The built-in HTTP server does not allow directory traversals anymore.
    The built-in HTTP now sends correct MIME types for CSS and SVG.
    Added support for systemd socket activation.
    Made it possible to get autoPort behavior with either ipv4 or ipv6
    disabled.
    Fixed starting of an onHold-client in threaded mode.
- dropped patches:
  - libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch (upstreamed)
  - libvncserver-byteswap.patch (stop maintaining not upstreamed patch)
- modified patches:
  % libvncserver-0.9.10-ossl.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1546516801">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1547208000">- Fix devel package dependencies</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- update to version 0.9.12
  - Overall changes:
  * CMake now is the default build system, Autotools were removed.
  * In addition to TravisCI, all commits are now build-tested by AppVeyorCI.
  - LibVNCServer/LibVNCClient:
  * Numerous build fixes for Visual Studio compilers to the extent that
    one can now _build_ the project with these. The needed changes for
    successfully _running_ stuff will be implemented in 0.9.13.
  * Fixed building for Android and added build instructions.
  * Removed the unused PolarSSL wrapper.
  * Updated the bundled noVNC to latest release 1.0.0.
  * Allowed to use global LZO library instead of miniLZO.
  - LibVNCClient:
  * Support for OpenSSL 1.1.x.
  * Support for overriding the default rectangle decode handlers (with
    hardware-accelerated ones for instance) thanks to Balazs Ludmany.
  * vnc2mpg updated.
  * Added support for X509 server certificate verification as part of the
    handshake process thanks to Simon Waterman.
  * Added a TRLE decoder thanks to Wiki Wang.
  * Included Tight decoding optimizations from TurboVNC thanks to DRC.
  * Ported the SDL viewer from SDL 1.2 to SDL 2.0.
  * Numerous security fixes.
  * Added support for custom auth handlers in order to support additional
    security types.
  - LibVNCServer:
  * Websockets rework to remove obsolete code thanks to Andreas Weigel.
  * Ensured compatibility with gtk-vnc 0.7.0+ thanks to Michał Kępień.
  * The built-in webserver now sends correct MIME type for Javascript.
  * Numerous memory management issues fixed.
  * Made the TightVNC-style file transfer more stable.
- removed patches
  - LibVNCServer-CVE-2018-20021.patch (upstreamed)
  - LibVNCServer-CVE-2018-20023.patch (upstreamed)
  - libvncserver-0.9.10-ossl.patch (not upstreamed)
  - LibVNCServer-CVE-2018-15127.patch (upstreamed)
  - LibVNCServer-CVE-2018-6307.patch (upstreamed)
  - LibVNCServer-CVE-2018-20019.patch (upstreamed)
  - LibVNCServer-CVE-2018-7225.patch (upstreamed)
  - LibVNCServer-CVE-2018-20022.patch (upstreamed)
  - libvncserver-0.9.1-multilib.patch (cmake now)
  - LibVNCServer-CVE-2018-15126.patch (upstreamed)
  - LibVNCServer-CVE-2018-20020.patch (upstreamed)
  - LibVNCServer-CVE-2018-20024.patch (upstreamed)
- removed by upstream
  - libvncserver-config
- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549886400">- fix cmake build, add cmake-libdir.patch (upstream issue #281)</changelog>
  <changelog author="pgajdos@suse.com" date="1549886401">- use upstream commit, amend cmake-libdir.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1572868801">- turn the test suite on</changelog>
  <changelog author="fvogt@suse.com" date="1578657600">- Add patches to fix crash on shutdown:
  * avoid-pthread_join-if-backgroundLoop-is-FALSE.patch
  * fix-crash-on-shutdown.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1588593600">- deleted patches
  - LibVNCServer-CVE-2018-20749.patch (mistakenly added, it is
    already part of 0.9.12)</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- version update to 0.9.13 [bsc#1173477]
  [#]# Overall changes:
  * Small tweaks to the CMake build system.
  * The macOS server example was overhauled and is now the most feature-complete sample
    application of the project, ready for real-world use.
  * Lots of documentation updates and markdownifying.
  * The TravisCI continuous integration now also build-checks cross-compilation from
    Linux to Windows.
  * Setup a [Gitter community chat](https://gitter.im/LibVNC/libvncserver) for the project.
  [#]# LibVNCServer/LibVNCClient:
  * Both LibVNCServer and LibVNCClient now support an additional platform, namely
    Microsoft Windows. Building is supported with Visual Studio as well as MingGW.
  * The separate crypto routines used by LibVNCClient and LibVNCServer were refactored
    into an implementation common to both libraries.
  * Several security issues got fixed.
  * The bundled noVNC client is now at version 1.1.0 and included via a git submodule.
  [#]# LibVNCClient:
  * Added connect timeout as well as read timeout support thanks to Tobias Junghans.
  * Both TLS backends now do proper locking of network operations when multi-threaded
    thanks to Gaurav Ujjwal.
  * Fixed regression in Tight/Raw decoding introduced in 0.9.12 thanks to DRC.
  * Fixed encrypted connections to AnonTLS servers when using the OpenSSL back-end.
    Made possible by the profound research done by Gaurav Ujjwal.
  [#]# LibVNCServer:
  * Added a hooking function (`clientFramebufferUpdateRequestHook`) to deliver
    rfbFramebufferUpdateRequest messages from clients to the frame producer
    thanks to Jae Hyun Yoo.
  * Added SetDesktopSize/ExtendedDesktopSize support thanks to Floris Bos.
  * Added multi-threading support for MS Windows.
  * Fixed VNC repeater/proxy functionality that was broken in 0.9.12.
  * Fixed unstable WebSockets connections thanks to Sebastian Kranz.
- deleted patches
  - LibVNCServer-CVE-2019-15681.patch (upstreamed)
  - LibVNCServer-CVE-2019-15690.patch (upstreamed)
  - LibVNCServer-CVE-2019-20788.patch (upstreamed)
  - avoid-pthread_join-if-backgroundLoop-is-FALSE.patch (upstreamed)
  - cmake-libdir.patch (upstreamed)
  - fix-crash-on-shutdown.patch (upstreamed)</changelog>
  <changelog author="fcrozat@suse.com" date="1610107200">- Add many patches needed for GNOME Remote desktop (already in
  Fedora):
  * TLS security type enablement patches gh#LibVNC/libvncserver!234
  - 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch
  - 0002-libvncserver-Add-channel-security-handlers.patch
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch
  * Fix crash on all runs after the first gh#LibVNC/libvncserver!444 rh#1882718
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch
  * Fix another crasher glgo#GNOME/gnome-remote-desktop#45 rh#1882718
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631880000">- purposedly adding just this changelog entry
- previous version updates fixed also:
  * CVE-2020-14398 [bsc#1173880] -- improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  * CVE-2017-18922 [bsc#1173477] -- preauth buffer overwrite
  * CVE-2018-20748 [bsc#1123823] -- libvnc contains multiple heap out-of-bounds writes
  * CVE-2020-25708 [bsc#1178682] -- libvncserver/rfbserver.c has a divide by zero which could result in DoS
  * CVE-2018-21247 [bsc#1173874] -- uninitialized memory contents are vulnerable to Information leak
  * CVE-2018-20750 [bsc#1123832] -- heap out-of-bounds write vulnerability in libvncserver/rfbserver.c
  * CVE-2020-14397 [bsc#1173700] -- NULL pointer dereference in libvncserver/rfbregion.c
  * CVE-2019-20839 [bsc#1173875] -- buffer overflow in ConnectClientToUnixSock()
  * CVE-2020-14401 [bsc#1173694] -- potential integer overflows in libvncserver/scale.c
  * CVE-2020-14400 [bsc#1173691] -- Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  * CVE-2019-20840 [bsc#1173876] -- unaligned accesses in hybiReadAndDecode can lead to denial of service
  * CVE-2020-14399 [bsc#1173743] -- Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  * CVE-2020-14402 [bsc#1173701] -- out-of-bounds access via encodings.
  * CVE-2020-14403 [bsc#1173701]
  * CVE-2020-14404 [bsc#1173701]</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- version update to 0.9.14
  [#]# Overall changes:
  * Added more documentation (build system integration, repeater setup) and a legal FAQ.
  * Added [contribution guidelines](CONTRIBUTING.md).
  * Ported the TravisCI continous integration machinery to GitHub workflows.
  [#]# LibVNCServer/LibVNCClient:
  * Added [qemu extended key event].
  * Fixed several potential multiplication overflows.
  [#]# LibVNCClient:
  * Fixes of several memory leaks and buffer overflows.
  * Added UltraVNC's MSLogonII authentication scheme.
  * Fixed TLS interoperability with GnuTLS servers.
  * Fixed detection of newer UltraVNC and TightVNC servers.
  * Added support for [SetDesktopSize].
  * Added SSH tunneling example using libssh2.
  * Added some extensions to VeNCrypt in order to be compatible with a wider range of servers.
  [#]# LibVNCServer:
  * Fixes to the multi-threaded server implementation which should be a lot more sound now.
  * Fixed TightVNC-filetransfer file upload for 64-bit systems.
  * Fixes of crashes in the zlib compression.
  * Added support for [UTF8 clipboard data].
  * Fixed visual artifacts in framebuffer on ARM platforms.
  * Fixed several WebSockets bugs.
  * Fixed the UltraVNC-style repeater example.
  * Added support for larger framebuffers (two 4k screens possible now).
  * Added support for timeouts for outbound connections (to repeaters for instance).
  * Fixed out-of-bounds memory access in Tight encoding.
- modified patches
  % 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch (refreshed)
  % 0002-libvncserver-Add-channel-security-handlers.patch (refreshed)
- deleted patches
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch (upstreamed)
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch (upstreamed)
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch (upstreamed)
  - LibVNCServer-CVE-2020-29260.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- fix devel package dependencies (by Christophe Marin) [bsc#1247887]</changelog>
</package>
<package pkgid="2e7bf1c17be4821fe5877631cc7f2161b71906e69897a36d61c344d95fa15ca9" name="LibVNCServer-devel" arch="ppc64le">
  <version epoch="0" ver="0.9.14" rel="150600.3.3.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- Update to version 0.9.11
    Overall changes:
    LibVNCServer/LibVNCClient development now uses continous intregration,
    provided by TravisCI.
    LibVNCClient:
    Now initializes libgcrypt before use if the application did not do it.
    Fixes a crash when connection to Mac hosts
    (#45).
    Various fixes that result in more stable handling of malicious or broken
    servers.
    Removed broken and unmaintained H264 decoding.
    Some documentation fixes.
    Added hooks to WriteToTLS() for optional protection by mutex.
    LibVNCServer:
    Stability fixes for the WebSocket implementation.
    Replaced SHA1 implementation with the one from RFC 6234.
    The built-in HTTP server does not allow directory traversals anymore.
    The built-in HTTP now sends correct MIME types for CSS and SVG.
    Added support for systemd socket activation.
    Made it possible to get autoPort behavior with either ipv4 or ipv6
    disabled.
    Fixed starting of an onHold-client in threaded mode.
- dropped patches:
  - libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch (upstreamed)
  - libvncserver-byteswap.patch (stop maintaining not upstreamed patch)
- modified patches:
  % libvncserver-0.9.10-ossl.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1546516801">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1547208000">- Fix devel package dependencies</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- update to version 0.9.12
  - Overall changes:
  * CMake now is the default build system, Autotools were removed.
  * In addition to TravisCI, all commits are now build-tested by AppVeyorCI.
  - LibVNCServer/LibVNCClient:
  * Numerous build fixes for Visual Studio compilers to the extent that
    one can now _build_ the project with these. The needed changes for
    successfully _running_ stuff will be implemented in 0.9.13.
  * Fixed building for Android and added build instructions.
  * Removed the unused PolarSSL wrapper.
  * Updated the bundled noVNC to latest release 1.0.0.
  * Allowed to use global LZO library instead of miniLZO.
  - LibVNCClient:
  * Support for OpenSSL 1.1.x.
  * Support for overriding the default rectangle decode handlers (with
    hardware-accelerated ones for instance) thanks to Balazs Ludmany.
  * vnc2mpg updated.
  * Added support for X509 server certificate verification as part of the
    handshake process thanks to Simon Waterman.
  * Added a TRLE decoder thanks to Wiki Wang.
  * Included Tight decoding optimizations from TurboVNC thanks to DRC.
  * Ported the SDL viewer from SDL 1.2 to SDL 2.0.
  * Numerous security fixes.
  * Added support for custom auth handlers in order to support additional
    security types.
  - LibVNCServer:
  * Websockets rework to remove obsolete code thanks to Andreas Weigel.
  * Ensured compatibility with gtk-vnc 0.7.0+ thanks to Michał Kępień.
  * The built-in webserver now sends correct MIME type for Javascript.
  * Numerous memory management issues fixed.
  * Made the TightVNC-style file transfer more stable.
- removed patches
  - LibVNCServer-CVE-2018-20021.patch (upstreamed)
  - LibVNCServer-CVE-2018-20023.patch (upstreamed)
  - libvncserver-0.9.10-ossl.patch (not upstreamed)
  - LibVNCServer-CVE-2018-15127.patch (upstreamed)
  - LibVNCServer-CVE-2018-6307.patch (upstreamed)
  - LibVNCServer-CVE-2018-20019.patch (upstreamed)
  - LibVNCServer-CVE-2018-7225.patch (upstreamed)
  - LibVNCServer-CVE-2018-20022.patch (upstreamed)
  - libvncserver-0.9.1-multilib.patch (cmake now)
  - LibVNCServer-CVE-2018-15126.patch (upstreamed)
  - LibVNCServer-CVE-2018-20020.patch (upstreamed)
  - LibVNCServer-CVE-2018-20024.patch (upstreamed)
- removed by upstream
  - libvncserver-config
- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549886400">- fix cmake build, add cmake-libdir.patch (upstream issue #281)</changelog>
  <changelog author="pgajdos@suse.com" date="1549886401">- use upstream commit, amend cmake-libdir.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1572868801">- turn the test suite on</changelog>
  <changelog author="fvogt@suse.com" date="1578657600">- Add patches to fix crash on shutdown:
  * avoid-pthread_join-if-backgroundLoop-is-FALSE.patch
  * fix-crash-on-shutdown.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1588593600">- deleted patches
  - LibVNCServer-CVE-2018-20749.patch (mistakenly added, it is
    already part of 0.9.12)</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- version update to 0.9.13 [bsc#1173477]
  [#]# Overall changes:
  * Small tweaks to the CMake build system.
  * The macOS server example was overhauled and is now the most feature-complete sample
    application of the project, ready for real-world use.
  * Lots of documentation updates and markdownifying.
  * The TravisCI continuous integration now also build-checks cross-compilation from
    Linux to Windows.
  * Setup a [Gitter community chat](https://gitter.im/LibVNC/libvncserver) for the project.
  [#]# LibVNCServer/LibVNCClient:
  * Both LibVNCServer and LibVNCClient now support an additional platform, namely
    Microsoft Windows. Building is supported with Visual Studio as well as MingGW.
  * The separate crypto routines used by LibVNCClient and LibVNCServer were refactored
    into an implementation common to both libraries.
  * Several security issues got fixed.
  * The bundled noVNC client is now at version 1.1.0 and included via a git submodule.
  [#]# LibVNCClient:
  * Added connect timeout as well as read timeout support thanks to Tobias Junghans.
  * Both TLS backends now do proper locking of network operations when multi-threaded
    thanks to Gaurav Ujjwal.
  * Fixed regression in Tight/Raw decoding introduced in 0.9.12 thanks to DRC.
  * Fixed encrypted connections to AnonTLS servers when using the OpenSSL back-end.
    Made possible by the profound research done by Gaurav Ujjwal.
  [#]# LibVNCServer:
  * Added a hooking function (`clientFramebufferUpdateRequestHook`) to deliver
    rfbFramebufferUpdateRequest messages from clients to the frame producer
    thanks to Jae Hyun Yoo.
  * Added SetDesktopSize/ExtendedDesktopSize support thanks to Floris Bos.
  * Added multi-threading support for MS Windows.
  * Fixed VNC repeater/proxy functionality that was broken in 0.9.12.
  * Fixed unstable WebSockets connections thanks to Sebastian Kranz.
- deleted patches
  - LibVNCServer-CVE-2019-15681.patch (upstreamed)
  - LibVNCServer-CVE-2019-15690.patch (upstreamed)
  - LibVNCServer-CVE-2019-20788.patch (upstreamed)
  - avoid-pthread_join-if-backgroundLoop-is-FALSE.patch (upstreamed)
  - cmake-libdir.patch (upstreamed)
  - fix-crash-on-shutdown.patch (upstreamed)</changelog>
  <changelog author="fcrozat@suse.com" date="1610107200">- Add many patches needed for GNOME Remote desktop (already in
  Fedora):
  * TLS security type enablement patches gh#LibVNC/libvncserver!234
  - 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch
  - 0002-libvncserver-Add-channel-security-handlers.patch
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch
  * Fix crash on all runs after the first gh#LibVNC/libvncserver!444 rh#1882718
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch
  * Fix another crasher glgo#GNOME/gnome-remote-desktop#45 rh#1882718
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631880000">- purposedly adding just this changelog entry
- previous version updates fixed also:
  * CVE-2020-14398 [bsc#1173880] -- improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  * CVE-2017-18922 [bsc#1173477] -- preauth buffer overwrite
  * CVE-2018-20748 [bsc#1123823] -- libvnc contains multiple heap out-of-bounds writes
  * CVE-2020-25708 [bsc#1178682] -- libvncserver/rfbserver.c has a divide by zero which could result in DoS
  * CVE-2018-21247 [bsc#1173874] -- uninitialized memory contents are vulnerable to Information leak
  * CVE-2018-20750 [bsc#1123832] -- heap out-of-bounds write vulnerability in libvncserver/rfbserver.c
  * CVE-2020-14397 [bsc#1173700] -- NULL pointer dereference in libvncserver/rfbregion.c
  * CVE-2019-20839 [bsc#1173875] -- buffer overflow in ConnectClientToUnixSock()
  * CVE-2020-14401 [bsc#1173694] -- potential integer overflows in libvncserver/scale.c
  * CVE-2020-14400 [bsc#1173691] -- Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  * CVE-2019-20840 [bsc#1173876] -- unaligned accesses in hybiReadAndDecode can lead to denial of service
  * CVE-2020-14399 [bsc#1173743] -- Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  * CVE-2020-14402 [bsc#1173701] -- out-of-bounds access via encodings.
  * CVE-2020-14403 [bsc#1173701]
  * CVE-2020-14404 [bsc#1173701]</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- version update to 0.9.14
  [#]# Overall changes:
  * Added more documentation (build system integration, repeater setup) and a legal FAQ.
  * Added [contribution guidelines](CONTRIBUTING.md).
  * Ported the TravisCI continous integration machinery to GitHub workflows.
  [#]# LibVNCServer/LibVNCClient:
  * Added [qemu extended key event].
  * Fixed several potential multiplication overflows.
  [#]# LibVNCClient:
  * Fixes of several memory leaks and buffer overflows.
  * Added UltraVNC's MSLogonII authentication scheme.
  * Fixed TLS interoperability with GnuTLS servers.
  * Fixed detection of newer UltraVNC and TightVNC servers.
  * Added support for [SetDesktopSize].
  * Added SSH tunneling example using libssh2.
  * Added some extensions to VeNCrypt in order to be compatible with a wider range of servers.
  [#]# LibVNCServer:
  * Fixes to the multi-threaded server implementation which should be a lot more sound now.
  * Fixed TightVNC-filetransfer file upload for 64-bit systems.
  * Fixes of crashes in the zlib compression.
  * Added support for [UTF8 clipboard data].
  * Fixed visual artifacts in framebuffer on ARM platforms.
  * Fixed several WebSockets bugs.
  * Fixed the UltraVNC-style repeater example.
  * Added support for larger framebuffers (two 4k screens possible now).
  * Added support for timeouts for outbound connections (to repeaters for instance).
  * Fixed out-of-bounds memory access in Tight encoding.
- modified patches
  % 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch (refreshed)
  % 0002-libvncserver-Add-channel-security-handlers.patch (refreshed)
- deleted patches
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch (upstreamed)
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch (upstreamed)
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch (upstreamed)
  - LibVNCServer-CVE-2020-29260.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- fix devel package dependencies (by Christophe Marin) [bsc#1247887]</changelog>
</package>
<package pkgid="86faf135ecec936eb4faa6c6cc640663c9ead6bd3d2362f0b9f0e35e23c3bc68" name="LibVNCServer-devel" arch="s390x">
  <version epoch="0" ver="0.9.14" rel="150600.3.3.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- Update to version 0.9.11
    Overall changes:
    LibVNCServer/LibVNCClient development now uses continous intregration,
    provided by TravisCI.
    LibVNCClient:
    Now initializes libgcrypt before use if the application did not do it.
    Fixes a crash when connection to Mac hosts
    (#45).
    Various fixes that result in more stable handling of malicious or broken
    servers.
    Removed broken and unmaintained H264 decoding.
    Some documentation fixes.
    Added hooks to WriteToTLS() for optional protection by mutex.
    LibVNCServer:
    Stability fixes for the WebSocket implementation.
    Replaced SHA1 implementation with the one from RFC 6234.
    The built-in HTTP server does not allow directory traversals anymore.
    The built-in HTTP now sends correct MIME types for CSS and SVG.
    Added support for systemd socket activation.
    Made it possible to get autoPort behavior with either ipv4 or ipv6
    disabled.
    Fixed starting of an onHold-client in threaded mode.
- dropped patches:
  - libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch (upstreamed)
  - libvncserver-byteswap.patch (stop maintaining not upstreamed patch)
- modified patches:
  % libvncserver-0.9.10-ossl.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1546516801">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1547208000">- Fix devel package dependencies</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- update to version 0.9.12
  - Overall changes:
  * CMake now is the default build system, Autotools were removed.
  * In addition to TravisCI, all commits are now build-tested by AppVeyorCI.
  - LibVNCServer/LibVNCClient:
  * Numerous build fixes for Visual Studio compilers to the extent that
    one can now _build_ the project with these. The needed changes for
    successfully _running_ stuff will be implemented in 0.9.13.
  * Fixed building for Android and added build instructions.
  * Removed the unused PolarSSL wrapper.
  * Updated the bundled noVNC to latest release 1.0.0.
  * Allowed to use global LZO library instead of miniLZO.
  - LibVNCClient:
  * Support for OpenSSL 1.1.x.
  * Support for overriding the default rectangle decode handlers (with
    hardware-accelerated ones for instance) thanks to Balazs Ludmany.
  * vnc2mpg updated.
  * Added support for X509 server certificate verification as part of the
    handshake process thanks to Simon Waterman.
  * Added a TRLE decoder thanks to Wiki Wang.
  * Included Tight decoding optimizations from TurboVNC thanks to DRC.
  * Ported the SDL viewer from SDL 1.2 to SDL 2.0.
  * Numerous security fixes.
  * Added support for custom auth handlers in order to support additional
    security types.
  - LibVNCServer:
  * Websockets rework to remove obsolete code thanks to Andreas Weigel.
  * Ensured compatibility with gtk-vnc 0.7.0+ thanks to Michał Kępień.
  * The built-in webserver now sends correct MIME type for Javascript.
  * Numerous memory management issues fixed.
  * Made the TightVNC-style file transfer more stable.
- removed patches
  - LibVNCServer-CVE-2018-20021.patch (upstreamed)
  - LibVNCServer-CVE-2018-20023.patch (upstreamed)
  - libvncserver-0.9.10-ossl.patch (not upstreamed)
  - LibVNCServer-CVE-2018-15127.patch (upstreamed)
  - LibVNCServer-CVE-2018-6307.patch (upstreamed)
  - LibVNCServer-CVE-2018-20019.patch (upstreamed)
  - LibVNCServer-CVE-2018-7225.patch (upstreamed)
  - LibVNCServer-CVE-2018-20022.patch (upstreamed)
  - libvncserver-0.9.1-multilib.patch (cmake now)
  - LibVNCServer-CVE-2018-15126.patch (upstreamed)
  - LibVNCServer-CVE-2018-20020.patch (upstreamed)
  - LibVNCServer-CVE-2018-20024.patch (upstreamed)
- removed by upstream
  - libvncserver-config
- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549886400">- fix cmake build, add cmake-libdir.patch (upstream issue #281)</changelog>
  <changelog author="pgajdos@suse.com" date="1549886401">- use upstream commit, amend cmake-libdir.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1572868801">- turn the test suite on</changelog>
  <changelog author="fvogt@suse.com" date="1578657600">- Add patches to fix crash on shutdown:
  * avoid-pthread_join-if-backgroundLoop-is-FALSE.patch
  * fix-crash-on-shutdown.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1588593600">- deleted patches
  - LibVNCServer-CVE-2018-20749.patch (mistakenly added, it is
    already part of 0.9.12)</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- version update to 0.9.13 [bsc#1173477]
  [#]# Overall changes:
  * Small tweaks to the CMake build system.
  * The macOS server example was overhauled and is now the most feature-complete sample
    application of the project, ready for real-world use.
  * Lots of documentation updates and markdownifying.
  * The TravisCI continuous integration now also build-checks cross-compilation from
    Linux to Windows.
  * Setup a [Gitter community chat](https://gitter.im/LibVNC/libvncserver) for the project.
  [#]# LibVNCServer/LibVNCClient:
  * Both LibVNCServer and LibVNCClient now support an additional platform, namely
    Microsoft Windows. Building is supported with Visual Studio as well as MingGW.
  * The separate crypto routines used by LibVNCClient and LibVNCServer were refactored
    into an implementation common to both libraries.
  * Several security issues got fixed.
  * The bundled noVNC client is now at version 1.1.0 and included via a git submodule.
  [#]# LibVNCClient:
  * Added connect timeout as well as read timeout support thanks to Tobias Junghans.
  * Both TLS backends now do proper locking of network operations when multi-threaded
    thanks to Gaurav Ujjwal.
  * Fixed regression in Tight/Raw decoding introduced in 0.9.12 thanks to DRC.
  * Fixed encrypted connections to AnonTLS servers when using the OpenSSL back-end.
    Made possible by the profound research done by Gaurav Ujjwal.
  [#]# LibVNCServer:
  * Added a hooking function (`clientFramebufferUpdateRequestHook`) to deliver
    rfbFramebufferUpdateRequest messages from clients to the frame producer
    thanks to Jae Hyun Yoo.
  * Added SetDesktopSize/ExtendedDesktopSize support thanks to Floris Bos.
  * Added multi-threading support for MS Windows.
  * Fixed VNC repeater/proxy functionality that was broken in 0.9.12.
  * Fixed unstable WebSockets connections thanks to Sebastian Kranz.
- deleted patches
  - LibVNCServer-CVE-2019-15681.patch (upstreamed)
  - LibVNCServer-CVE-2019-15690.patch (upstreamed)
  - LibVNCServer-CVE-2019-20788.patch (upstreamed)
  - avoid-pthread_join-if-backgroundLoop-is-FALSE.patch (upstreamed)
  - cmake-libdir.patch (upstreamed)
  - fix-crash-on-shutdown.patch (upstreamed)</changelog>
  <changelog author="fcrozat@suse.com" date="1610107200">- Add many patches needed for GNOME Remote desktop (already in
  Fedora):
  * TLS security type enablement patches gh#LibVNC/libvncserver!234
  - 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch
  - 0002-libvncserver-Add-channel-security-handlers.patch
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch
  * Fix crash on all runs after the first gh#LibVNC/libvncserver!444 rh#1882718
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch
  * Fix another crasher glgo#GNOME/gnome-remote-desktop#45 rh#1882718
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631880000">- purposedly adding just this changelog entry
- previous version updates fixed also:
  * CVE-2020-14398 [bsc#1173880] -- improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  * CVE-2017-18922 [bsc#1173477] -- preauth buffer overwrite
  * CVE-2018-20748 [bsc#1123823] -- libvnc contains multiple heap out-of-bounds writes
  * CVE-2020-25708 [bsc#1178682] -- libvncserver/rfbserver.c has a divide by zero which could result in DoS
  * CVE-2018-21247 [bsc#1173874] -- uninitialized memory contents are vulnerable to Information leak
  * CVE-2018-20750 [bsc#1123832] -- heap out-of-bounds write vulnerability in libvncserver/rfbserver.c
  * CVE-2020-14397 [bsc#1173700] -- NULL pointer dereference in libvncserver/rfbregion.c
  * CVE-2019-20839 [bsc#1173875] -- buffer overflow in ConnectClientToUnixSock()
  * CVE-2020-14401 [bsc#1173694] -- potential integer overflows in libvncserver/scale.c
  * CVE-2020-14400 [bsc#1173691] -- Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  * CVE-2019-20840 [bsc#1173876] -- unaligned accesses in hybiReadAndDecode can lead to denial of service
  * CVE-2020-14399 [bsc#1173743] -- Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  * CVE-2020-14402 [bsc#1173701] -- out-of-bounds access via encodings.
  * CVE-2020-14403 [bsc#1173701]
  * CVE-2020-14404 [bsc#1173701]</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- version update to 0.9.14
  [#]# Overall changes:
  * Added more documentation (build system integration, repeater setup) and a legal FAQ.
  * Added [contribution guidelines](CONTRIBUTING.md).
  * Ported the TravisCI continous integration machinery to GitHub workflows.
  [#]# LibVNCServer/LibVNCClient:
  * Added [qemu extended key event].
  * Fixed several potential multiplication overflows.
  [#]# LibVNCClient:
  * Fixes of several memory leaks and buffer overflows.
  * Added UltraVNC's MSLogonII authentication scheme.
  * Fixed TLS interoperability with GnuTLS servers.
  * Fixed detection of newer UltraVNC and TightVNC servers.
  * Added support for [SetDesktopSize].
  * Added SSH tunneling example using libssh2.
  * Added some extensions to VeNCrypt in order to be compatible with a wider range of servers.
  [#]# LibVNCServer:
  * Fixes to the multi-threaded server implementation which should be a lot more sound now.
  * Fixed TightVNC-filetransfer file upload for 64-bit systems.
  * Fixes of crashes in the zlib compression.
  * Added support for [UTF8 clipboard data].
  * Fixed visual artifacts in framebuffer on ARM platforms.
  * Fixed several WebSockets bugs.
  * Fixed the UltraVNC-style repeater example.
  * Added support for larger framebuffers (two 4k screens possible now).
  * Added support for timeouts for outbound connections (to repeaters for instance).
  * Fixed out-of-bounds memory access in Tight encoding.
- modified patches
  % 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch (refreshed)
  % 0002-libvncserver-Add-channel-security-handlers.patch (refreshed)
- deleted patches
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch (upstreamed)
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch (upstreamed)
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch (upstreamed)
  - LibVNCServer-CVE-2020-29260.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- fix devel package dependencies (by Christophe Marin) [bsc#1247887]</changelog>
</package>
<package pkgid="d7026c3758283a378d82daabb12f1c99124627459054d46eb0235be55358eb9a" name="LibVNCServer-devel" arch="x86_64">
  <version epoch="0" ver="0.9.14" rel="150600.3.3.1"/>
  <changelog author="antoine.belvire@laposte.net" date="1464091200">- Fix build errors of applications using stl_algobase.h and
  libvncserver's rfbproto.h, e.g. krfb (issue #102)
  * Add libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1521547200">- security update
  * CVE-2018-7225 [bsc#1081493]
    + LibVNCServer-CVE-2018-7225.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1546516800">- Update to version 0.9.11
    Overall changes:
    LibVNCServer/LibVNCClient development now uses continous intregration,
    provided by TravisCI.
    LibVNCClient:
    Now initializes libgcrypt before use if the application did not do it.
    Fixes a crash when connection to Mac hosts
    (#45).
    Various fixes that result in more stable handling of malicious or broken
    servers.
    Removed broken and unmaintained H264 decoding.
    Some documentation fixes.
    Added hooks to WriteToTLS() for optional protection by mutex.
    LibVNCServer:
    Stability fixes for the WebSocket implementation.
    Replaced SHA1 implementation with the one from RFC 6234.
    The built-in HTTP server does not allow directory traversals anymore.
    The built-in HTTP now sends correct MIME types for CSS and SVG.
    Added support for systemd socket activation.
    Made it possible to get autoPort behavior with either ipv4 or ipv6
    disabled.
    Fixed starting of an onHold-client in threaded mode.
- dropped patches:
  - libvncserver-0.9.10-use-namespaced-rfbMax-macro.patch (upstreamed)
  - libvncserver-byteswap.patch (stop maintaining not upstreamed patch)
- modified patches:
  % libvncserver-0.9.10-ossl.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1546516801">- security update
  * CVE-2018-15126 [bsc#1120114]
    + LibVNCServer-CVE-2018-15126.patch
  * CVE-2018-6307 [bsc#1120115]
    + LibVNCServer-CVE-2018-6307.patch
  * CVE-2018-20020 [bsc#1120116]
    + LibVNCServer-CVE-2018-20020.patch
  * CVE-2018-15127 [bsc#1120117]
    + LibVNCServer-CVE-2018-15127.patch
  * CVE-2018-20019 [bsc#1120118]
    + LibVNCServer-CVE-2018-20019.patch
  * CVE-2018-20023 [bsc#1120119]
    + LibVNCServer-CVE-2018-20023.patch
  * CVE-2018-20022 [bsc#1120120]
    + LibVNCServer-CVE-2018-20022.patch
  * CVE-2018-20024 [bsc#1120121]
    + LibVNCServer-CVE-2018-20024.patch
  * CVE-2018-20021 [bsc#1120122]
    + LibVNCServer-CVE-2018-20021.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1547208000">- Fix devel package dependencies</changelog>
  <changelog author="pgajdos@suse.com" date="1549368000">- update to version 0.9.12
  - Overall changes:
  * CMake now is the default build system, Autotools were removed.
  * In addition to TravisCI, all commits are now build-tested by AppVeyorCI.
  - LibVNCServer/LibVNCClient:
  * Numerous build fixes for Visual Studio compilers to the extent that
    one can now _build_ the project with these. The needed changes for
    successfully _running_ stuff will be implemented in 0.9.13.
  * Fixed building for Android and added build instructions.
  * Removed the unused PolarSSL wrapper.
  * Updated the bundled noVNC to latest release 1.0.0.
  * Allowed to use global LZO library instead of miniLZO.
  - LibVNCClient:
  * Support for OpenSSL 1.1.x.
  * Support for overriding the default rectangle decode handlers (with
    hardware-accelerated ones for instance) thanks to Balazs Ludmany.
  * vnc2mpg updated.
  * Added support for X509 server certificate verification as part of the
    handshake process thanks to Simon Waterman.
  * Added a TRLE decoder thanks to Wiki Wang.
  * Included Tight decoding optimizations from TurboVNC thanks to DRC.
  * Ported the SDL viewer from SDL 1.2 to SDL 2.0.
  * Numerous security fixes.
  * Added support for custom auth handlers in order to support additional
    security types.
  - LibVNCServer:
  * Websockets rework to remove obsolete code thanks to Andreas Weigel.
  * Ensured compatibility with gtk-vnc 0.7.0+ thanks to Michał Kępień.
  * The built-in webserver now sends correct MIME type for Javascript.
  * Numerous memory management issues fixed.
  * Made the TightVNC-style file transfer more stable.
- removed patches
  - LibVNCServer-CVE-2018-20021.patch (upstreamed)
  - LibVNCServer-CVE-2018-20023.patch (upstreamed)
  - libvncserver-0.9.10-ossl.patch (not upstreamed)
  - LibVNCServer-CVE-2018-15127.patch (upstreamed)
  - LibVNCServer-CVE-2018-6307.patch (upstreamed)
  - LibVNCServer-CVE-2018-20019.patch (upstreamed)
  - LibVNCServer-CVE-2018-7225.patch (upstreamed)
  - LibVNCServer-CVE-2018-20022.patch (upstreamed)
  - libvncserver-0.9.1-multilib.patch (cmake now)
  - LibVNCServer-CVE-2018-15126.patch (upstreamed)
  - LibVNCServer-CVE-2018-20020.patch (upstreamed)
  - LibVNCServer-CVE-2018-20024.patch (upstreamed)
- removed by upstream
  - libvncserver-config
- security update
  * CVE-2018-20749 [bsc#1123828]
    + LibVNCServer-CVE-2018-20749.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1549886400">- fix cmake build, add cmake-libdir.patch (upstream issue #281)</changelog>
  <changelog author="pgajdos@suse.com" date="1549886401">- use upstream commit, amend cmake-libdir.patch</changelog>
  <changelog author="fezhang@suse.com" date="1550664000">- Add BuildRequire libgnutls-devel: Remmina needs it for VNC
  connections (boo#1123805)</changelog>
  <changelog author="pgajdos@suse.com" date="1572868800">- security update
- added patches
  CVE-2019-15681 [bsc#1155419]
  + LibVNCServer-CVE-2019-15681.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1572868801">- turn the test suite on</changelog>
  <changelog author="fvogt@suse.com" date="1578657600">- Add patches to fix crash on shutdown:
  * avoid-pthread_join-if-backgroundLoop-is-FALSE.patch
  * fix-crash-on-shutdown.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1587988800">- security update
- added patches
  fix CVE-2019-15690 [bsc#1160471], heap buffer overflow
  + LibVNCServer-CVE-2019-15690.patch
  fix CVE-2019-20788 [bsc#1170441], integer overflow and heap-based buffer overflow via a large height or width value
  + LibVNCServer-CVE-2019-20788.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1588593600">- deleted patches
  - LibVNCServer-CVE-2018-20749.patch (mistakenly added, it is
    already part of 0.9.12)</changelog>
  <changelog author="pgajdos@suse.com" date="1593518400">- version update to 0.9.13 [bsc#1173477]
  [#]# Overall changes:
  * Small tweaks to the CMake build system.
  * The macOS server example was overhauled and is now the most feature-complete sample
    application of the project, ready for real-world use.
  * Lots of documentation updates and markdownifying.
  * The TravisCI continuous integration now also build-checks cross-compilation from
    Linux to Windows.
  * Setup a [Gitter community chat](https://gitter.im/LibVNC/libvncserver) for the project.
  [#]# LibVNCServer/LibVNCClient:
  * Both LibVNCServer and LibVNCClient now support an additional platform, namely
    Microsoft Windows. Building is supported with Visual Studio as well as MingGW.
  * The separate crypto routines used by LibVNCClient and LibVNCServer were refactored
    into an implementation common to both libraries.
  * Several security issues got fixed.
  * The bundled noVNC client is now at version 1.1.0 and included via a git submodule.
  [#]# LibVNCClient:
  * Added connect timeout as well as read timeout support thanks to Tobias Junghans.
  * Both TLS backends now do proper locking of network operations when multi-threaded
    thanks to Gaurav Ujjwal.
  * Fixed regression in Tight/Raw decoding introduced in 0.9.12 thanks to DRC.
  * Fixed encrypted connections to AnonTLS servers when using the OpenSSL back-end.
    Made possible by the profound research done by Gaurav Ujjwal.
  [#]# LibVNCServer:
  * Added a hooking function (`clientFramebufferUpdateRequestHook`) to deliver
    rfbFramebufferUpdateRequest messages from clients to the frame producer
    thanks to Jae Hyun Yoo.
  * Added SetDesktopSize/ExtendedDesktopSize support thanks to Floris Bos.
  * Added multi-threading support for MS Windows.
  * Fixed VNC repeater/proxy functionality that was broken in 0.9.12.
  * Fixed unstable WebSockets connections thanks to Sebastian Kranz.
- deleted patches
  - LibVNCServer-CVE-2019-15681.patch (upstreamed)
  - LibVNCServer-CVE-2019-15690.patch (upstreamed)
  - LibVNCServer-CVE-2019-20788.patch (upstreamed)
  - avoid-pthread_join-if-backgroundLoop-is-FALSE.patch (upstreamed)
  - cmake-libdir.patch (upstreamed)
  - fix-crash-on-shutdown.patch (upstreamed)</changelog>
  <changelog author="fcrozat@suse.com" date="1610107200">- Add many patches needed for GNOME Remote desktop (already in
  Fedora):
  * TLS security type enablement patches gh#LibVNC/libvncserver!234
  - 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch
  - 0002-libvncserver-Add-channel-security-handlers.patch
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch
  * Fix crash on all runs after the first gh#LibVNC/libvncserver!444 rh#1882718
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch
  * Fix another crasher glgo#GNOME/gnome-remote-desktop#45 rh#1882718
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631880000">- purposedly adding just this changelog entry
- previous version updates fixed also:
  * CVE-2020-14398 [bsc#1173880] -- improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
  * CVE-2017-18922 [bsc#1173477] -- preauth buffer overwrite
  * CVE-2018-20748 [bsc#1123823] -- libvnc contains multiple heap out-of-bounds writes
  * CVE-2020-25708 [bsc#1178682] -- libvncserver/rfbserver.c has a divide by zero which could result in DoS
  * CVE-2018-21247 [bsc#1173874] -- uninitialized memory contents are vulnerable to Information leak
  * CVE-2018-20750 [bsc#1123832] -- heap out-of-bounds write vulnerability in libvncserver/rfbserver.c
  * CVE-2020-14397 [bsc#1173700] -- NULL pointer dereference in libvncserver/rfbregion.c
  * CVE-2019-20839 [bsc#1173875] -- buffer overflow in ConnectClientToUnixSock()
  * CVE-2020-14401 [bsc#1173694] -- potential integer overflows in libvncserver/scale.c
  * CVE-2020-14400 [bsc#1173691] -- Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
  * CVE-2019-20840 [bsc#1173876] -- unaligned accesses in hybiReadAndDecode can lead to denial of service
  * CVE-2020-14399 [bsc#1173743] -- Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
  * CVE-2020-14402 [bsc#1173701] -- out-of-bounds access via encodings.
  * CVE-2020-14403 [bsc#1173701]
  * CVE-2020-14404 [bsc#1173701]</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-29260 [bsc#1203106], memory leakage via rfbClientCleanup()
  + LibVNCServer-CVE-2020-29260.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- version update to 0.9.14
  [#]# Overall changes:
  * Added more documentation (build system integration, repeater setup) and a legal FAQ.
  * Added [contribution guidelines](CONTRIBUTING.md).
  * Ported the TravisCI continous integration machinery to GitHub workflows.
  [#]# LibVNCServer/LibVNCClient:
  * Added [qemu extended key event].
  * Fixed several potential multiplication overflows.
  [#]# LibVNCClient:
  * Fixes of several memory leaks and buffer overflows.
  * Added UltraVNC's MSLogonII authentication scheme.
  * Fixed TLS interoperability with GnuTLS servers.
  * Fixed detection of newer UltraVNC and TightVNC servers.
  * Added support for [SetDesktopSize].
  * Added SSH tunneling example using libssh2.
  * Added some extensions to VeNCrypt in order to be compatible with a wider range of servers.
  [#]# LibVNCServer:
  * Fixes to the multi-threaded server implementation which should be a lot more sound now.
  * Fixed TightVNC-filetransfer file upload for 64-bit systems.
  * Fixes of crashes in the zlib compression.
  * Added support for [UTF8 clipboard data].
  * Fixed visual artifacts in framebuffer on ARM platforms.
  * Fixed several WebSockets bugs.
  * Fixed the UltraVNC-style repeater example.
  * Added support for larger framebuffers (two 4k screens possible now).
  * Added support for timeouts for outbound connections (to repeaters for instance).
  * Fixed out-of-bounds memory access in Tight encoding.
- modified patches
  % 0001-libvncserver-Add-API-to-add-custom-I-O-entry-points.patch (refreshed)
  % 0002-libvncserver-Add-channel-security-handlers.patch (refreshed)
- deleted patches
  - 0001-libvncserver-don-t-NULL-out-internal-of-the-default-.patch (upstreamed)
  - 0003-libvncserver-auth-don-t-keep-security-handlers-from-.patch (upstreamed)
  - 0004-zlib-Clear-buffer-pointers-on-cleanup-444.patch (upstreamed)
  - LibVNCServer-CVE-2020-29260.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- fix devel package dependencies (by Christophe Marin) [bsc#1247887]</changelog>
</package>
<package pkgid="538ccb523dc43f1e00a50b18f6fa9288a644e037410775107ccb820c2b782899" name="Mesa" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ff8ce9044b5a375a23a252186165fcb5fe198e71b9c7c755acadfa20c55b65a" name="Mesa" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f975b24613315011daff881124f7731801fbfa2b4f95b43fabe819e8115aa21c" name="Mesa" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a705e70e3c533c4ebbb87fa76c7c34c5d3b54bef1dfcd69517cad8de1ba05016" name="Mesa" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59534e8eec4e576130ecdd1677fc8d275ac00fc4d0c8a55546aba2bafff3f2cd" name="Mesa" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d22fbb0f09abcc011c4275b2443dc8e7b4f8e0ad33b176c34fcbe87f43a31eab" name="Mesa-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="18eedf6fbaf0283aff1ffd25f1b8fe408ea768ad5afad1450662d1e336590da7" name="Mesa-KHR-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2a24e2b784af480f15e4f326fafa0878040c65d3985a6e7eb7916f35ba2f8726" name="Mesa-KHR-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2c28dcc2e2112857d9094e53a938ccb30cd8394b0947205e75fabcfcb8ffb2c3" name="Mesa-KHR-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a15b75d61f3d0cc156a4300d172288c3f1d762e84934e8841255a0bc8e2f01fe" name="Mesa-KHR-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="54b6564cbf45c22caea3a0fa53dde6560d928fdc17c1409bac655be8e42efaf5" name="Mesa-demo" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="ddbd4a58cb01597f9ae1a969a33eb1417f73b778df5f5a146a0709ebb30c7342" name="Mesa-demo" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="fb5d415d85edc40a30c40e8d9d63e80b68c71c03c7ad25f402c975f8ac16cd85" name="Mesa-demo" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="b773c85d8bce0f0c2a73ec04435e49092fc26cf0575005035dafa984825c61d6" name="Mesa-demo" arch="src">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="sndirsch@suse.com" date="1326283200">- added automake to BuildRequires to build fix on factory</changelog>
  <changelog author="cfarrell@suse.com" date="1326369600">- license update: MIT
  SPDX format</changelog>
  <changelog author="sndirsch@suse.com" date="1327406400">- renamed package to MesaDemos</changelog>
  <changelog author="sndirsch@suse.com" date="1328702400">- renamed package to Mesa-demo
- spefile cleanup</changelog>
  <changelog author="jengelh@medozas.de" date="1329134400">- Update package BuildRequires to use pkgconfig symbols</changelog>
  <changelog author="sndirsch@suse.com" date="1331812800">- added "-x" subpackage for most common GLX-based demos like
  glxgears, glxinfo, pbinfo (bnc #748373)</changelog>
  <changelog author="sndirsch@suse.com" date="1336651200">- fixed build by making use of autoreconf</changelog>
  <changelog author="sndirsch@suse.com" date="1348488000">- fixed build by replacing these strange osdemo{,16,32} scripts
  by the proper binaries</changelog>
  <changelog author="sndirsch@suse.com" date="1348574400">- reverted previous change; seems this is no longer necessary</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1361707200">- Update to version 8.1.0
  * changes for OpenGL Core Profile
  * Wayland support within eglut
  * various updates to the OpenGL tests/demos
  * glxgears now supports multi-sample visuals
  * new EGL/OpenVG tests
  * large number of other changes</changelog>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="6b08c1c5c43f44b3cb2ecabeeb430a6e7dd4fb7794d2a718e35b0a5b5a03d209" name="Mesa-demo" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="f1ebdc2b17bbc68124c93db59d16de6f0b2fdf0c93e508a3c9fa5d3a1c8fbebc" name="Mesa-demo" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="2a8818ec61a5edd399b454367cf290c90d6f598cddf64b1fab29a93d9e8c6d18" name="Mesa-demo" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="5e8c194d3769315bf7cceb0fa66102fd381d8da881f63106834513f868fa960e" name="Mesa-demo" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="25c7e36a7d3a49f1aca0b1f7bf2ad7078197d7983e578fd2476202c3c793f3ab" name="Mesa-demo" arch="src">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="cfarrell@suse.com" date="1326369600">- license update: MIT
  SPDX format</changelog>
  <changelog author="sndirsch@suse.com" date="1327406400">- renamed package to MesaDemos</changelog>
  <changelog author="sndirsch@suse.com" date="1328702400">- renamed package to Mesa-demo
- spefile cleanup</changelog>
  <changelog author="jengelh@medozas.de" date="1329134400">- Update package BuildRequires to use pkgconfig symbols</changelog>
  <changelog author="sndirsch@suse.com" date="1331812800">- added "-x" subpackage for most common GLX-based demos like
  glxgears, glxinfo, pbinfo (bnc #748373)</changelog>
  <changelog author="sndirsch@suse.com" date="1336651200">- fixed build by making use of autoreconf</changelog>
  <changelog author="sndirsch@suse.com" date="1348488000">- fixed build by replacing these strange osdemo{,16,32} scripts
  by the proper binaries</changelog>
  <changelog author="sndirsch@suse.com" date="1348574400">- reverted previous change; seems this is no longer necessary</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1361707200">- Update to version 8.1.0
  * changes for OpenGL Core Profile
  * Wayland support within eglut
  * various updates to the OpenGL tests/demos
  * glxgears now supports multi-sample visuals
  * new EGL/OpenVG tests
  * large number of other changes</changelog>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="618d621eb99d38d8a49eae1ee5bf7915c5f216cc440da4b375a3b65032b0879c" name="Mesa-demo" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="6127462136d413a968826276c2ff155a2c70bfb9fe6aa3d2476aace9d2e0f22d" name="Mesa-demo-x" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="c918d221f70629e538250a359031839a738cf928e8f964928035ed1d4b44b8a6" name="Mesa-demo-x" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="0b32c1c1320bbfd8be38bdc73f26a2672e23241d796860f561164b3f67557935" name="Mesa-demo-x" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="4d137072675f1312515da4d32ba5b09d6dfa9ef2b47f792e0309d13a183e5875" name="Mesa-demo-x" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="34a3a02e355a1556d738e5272f1310c87cd400dece9b047204842567fcc236b8" name="Mesa-demo-x" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="56e6ebdfca2531a62475c7db60ebe54ebe57b02a4f8283a54c76e216be77f431" name="Mesa-demo-x" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="d3f2deb5e14030ee69d84fd4b71886a705d16050a0d4dd33bf426be0cdf3cb70" name="Mesa-demo-x" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="e5caf330b48c65eb06d0776cfb3272b512ccdf4c54a3bcc8337a4f8a02a51b53" name="Mesa-demo-x" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="80065c08f49029a4e0b8993deedba375f419a5841049b661dc246ce6937b41a9" name="Mesa-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e4df26cb2d1a961e29142c69cff86d6173db9c6fd40dfb70ec00990969f2601e" name="Mesa-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="05d630c1b19786df3dfe80bb16385f83e800d0584a6e34e43a2f382f515fb154" name="Mesa-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="5beb4fa7791cd75ff48e932d607b4a3d83e31a715ffc2506c9eb24d27458cb87" name="Mesa-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3450623cb40065a95edf7a65168fee2a9e9d0e73a2d762ea1a1f0fbe44ac3df3" name="Mesa-dri" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b85c3a5c8494198c7074dd095190519823b4faf963a0093fa2304b192290888a" name="Mesa-dri" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="edc89c978bda4f7158680b245003621a9b71353e062cda63420031abf11c9957" name="Mesa-dri" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3e09091ccb69b9be1c8f7af5cf162d809f8b23ddaf5ed9b79ccbd5b780b84493" name="Mesa-dri" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="932e0835005cb2c8fecda3c1036e0134e5d354896f4ff750bd677ba7b83e067e" name="Mesa-dri-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64d4475f6d056ff2827fa4f191d9d7fe62859fb4ed5b1a9050d341ab159f1114" name="Mesa-dri-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fca088335b7c01ce8455930e2b94784f5c0147faae8c42317e4678699f7fd796" name="Mesa-dri-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a7fc42fd38eb990b86841f735d964c03d03f2f3226f2bb036d870d976105fafd" name="Mesa-dri-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="daa3fd3f57de23c48cda460c51696aedb2527a22b68d6717feecce75f672b311" name="Mesa-dri-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e9145d09855903d979f6030baa3873ad42dbcfe57a1f55b288d8b15319c22ade" name="Mesa-dri-nouveau" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64351c63a47b2a09d0cf4ee91edaf72da6d0521ddbbd9b3e7631a319ee247573" name="Mesa-dri-nouveau" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9866a0ac7173e32ae06e42d3344b5d440a4241b0441f3c90ce15638018310346" name="Mesa-dri-nouveau" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d60c22fd7ebbf41bf19a7a3007b2aa5d7779b4677f0916ef36abc332b4b22ce2" name="Mesa-dri-nouveau-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="637dd4a730f9f447f70df22f3290e0ffab7f48e9cb83a85504f9d58a6ddc092b" name="Mesa-dri-vc4" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4cbb5f7aa8697f5624993d26192dc724a1d148ad34fca3128ee8d5ed07adae4d" name="Mesa-drivers" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c33245cbe7c4878a294857de3f71d66780f19eadc9eb71813afc469101a90545" name="Mesa-gallium" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d4dc999f06c78163d82722cf91702451d72619714065cff5d1357b3fcff1a9a8" name="Mesa-gallium" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="209d876d9db8a0c8114943f4e9b46cee8193f0726d04701733b9c682345e4b6d" name="Mesa-gallium" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fcfa46cf55b2d9abdfdcf57fb35f885def9fff7b02768c6d01bc5d505c1d6b14" name="Mesa-gallium-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="921d565bda22dbfb5c2fd4741c140833a3dc43f7c9ded54c02dca6a5bc86e9da" name="Mesa-libEGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ab0b12d1347c74f3d41eda45b0920b0d5eb7c4d1e5f57c9751bfc9adc93df2df" name="Mesa-libEGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="350c559e5801d8663d03bd55cac46f8404470531970b54ab2f38c4440de588b7" name="Mesa-libEGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4953bf6cff208cb8f7212e09c27638bd3ff1fb6f7f682120a51d5d3878d43ef1" name="Mesa-libEGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="910d6e4e2abbc15fb5636522ddf363ac0a39ad7586276a4f6673fa8e591c294e" name="Mesa-libEGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4edd97e2e145ed6250c5e49370f1e463ada074e19847be3b4fc9b455f22b83c9" name="Mesa-libEGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d1b204f505c749937363d910512a28d8a31675d42214dee2027e0b991853e95e" name="Mesa-libEGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f967a9c59ab6a89a72187b0862c15beb02f81cfa120970ea54afc94cc3703c94" name="Mesa-libEGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0862cfb043700377ce1e8b7b73a5ce807daecc634d25f25c5c88e03bcd4196d7" name="Mesa-libEGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="874585c0474aeb6faadb57cd4d77d3f582e6f5ffae7105311ad25bcb9d5f6a6d" name="Mesa-libEGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bc3c6373e6a407df04f2ca98430cc36be2bff77ba0eb870ded0c94712f15c311" name="Mesa-libGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="08ff55330b3f84fc9dc6ffbab185dac38acaf48025bffc327d9999aa2bdba902" name="Mesa-libGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="69ca303d8431dcc227fcb8dde0dcc0cd515a435289b2525eb7da1213936c9d6a" name="Mesa-libGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a57a3ad5d1093f0af760f382d51d0fc0eec976d40ca9c572633c312343261484" name="Mesa-libGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ca0652030034dbc6e0b37447df1b0e9589237551951518abbcd8eeb187815a3" name="Mesa-libGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="73d0a357d8d410ebb3b929d1b1a23fc63f880612705506076fe1cc3a372b7efe" name="Mesa-libGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bd8011f44e743013c881494346e0aae7f43ae044e2c7008af2c37ce8b5e54974" name="Mesa-libGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="50fae9c380bdb59badba7effab955db12589ce1011e35dbf9932e9e643992ff8" name="Mesa-libGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d58cd2073611a17f8011e0854901353dd1f0d397d44f44b2ea296e3d3ff2fdb5" name="Mesa-libGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e41d4a8f8fa1fea9cdc7b1c79d120a20f63aab2412746b2759f1a06765e1244f" name="Mesa-libGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="107895580ce9ee4e293eed7b8d3150550f432eb1ba017628f731e3142c5b64e1" name="Mesa-libGLESv1_CM-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f7420fdd9d2fcb2ac17beac8ead7ee4c04ba1d5e101803db28eb41e67bef094f" name="Mesa-libGLESv1_CM-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f968f61f8c027a95f21c823609fe20bc56cb1a57ab265ade34a01204e5f85f99" name="Mesa-libGLESv1_CM-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="80d9f2abe4d30e97ad306894f113160e09bb713d487cc68033e39a6059475b08" name="Mesa-libGLESv1_CM-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a0a1b5cc82b1e66a92e1a87b09e207b96ce4f76ab874dea653de4736b722f61f" name="Mesa-libGLESv1_CM-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4736d53d75239109d7b06a9ca874f2d50b57f3ba37b32bdcdabd9f0895afdca0" name="Mesa-libGLESv2-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="33b47411c40751a89f50f6247d348b276455dc01236a33c5118098ec52c09895" name="Mesa-libGLESv2-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="90d00e2bce3d804a9ec8a875e40553a7b4be35b94ca429d25dea604f39b2ca6f" name="Mesa-libGLESv2-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9e55767c1f68ba0ee5d7f87fe5b0cbb971432e54c77ed896bdbeed31c099c8ad" name="Mesa-libGLESv2-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59b7fc5411c4eecd247a05e155bf66dbf9ab5884ef26c045df650beae7280ded" name="Mesa-libGLESv2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ecb8d1de3d80bb1b2727948e722bcedd9b014c4038731d7e749955f74f629463" name="Mesa-libGLESv3-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b8d1901dc680a18c04107825a1312ad8dc34c1bbf1efebd4b15321321af9df5a" name="Mesa-libGLESv3-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b1833c3fb290c8fc44b91af055904ef96bf7078ac371de06f15c5a09c35d86fc" name="Mesa-libGLESv3-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3937ae7d4f3418f05e49c3d5089391830e06e8fd09d14e3788aa8ef671d1b19a" name="Mesa-libGLESv3-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a6eed22ec86822022557cb37d1fe80a22fe1feeaf705d16f67065f80e6a6a3b2" name="Mesa-libOpenCL" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0e2fa094dcfa7f77eb2979c55f43f7b2be19de79c078a2d7349eb673eb3f495d" name="Mesa-libOpenCL" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0d990d92ed0399b4e8d2057ee94afe67d31a254c53e5a10feba41d0f21baa49d" name="Mesa-libOpenCL" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="789b3bfd73e1fd6f2fcb989d915628bd317567b99076fbbf16bc72e439032e2f" name="Mesa-libd3d" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a474302381e089e6c81b574134bc3c827a72dd9f3a97a2c5c1fb4cb9bf73d9ba" name="Mesa-libd3d-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="770b9bfc1ac3a684e8ac716e82077dd470f1404de55afc295e97081802bea2e8" name="Mesa-libd3d-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c2fe226416f736323d4296a6323d65f1dae989c7defb6a4e1a2d2d0182f528da" name="Mesa-libd3d-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bba8a1a319a7fa2088dde55ff8b6991dcf83ffc32e58bda799bd69f4427f334" name="Mesa-libglapi-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="812c5cb275bf9eec7c0a824c00b45be6ca322a75d4e2effb4709b32411d0b9cd" name="Mesa-libglapi-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="cee1147049f8e8dd4122bcde873e673101d17e62c7f586068f6a4ec46bd775c5" name="Mesa-libglapi-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fde8f547c81251dab9290a95d0efe3a87501c7474bf4bd0516ad93fd3e42128e" name="Mesa-libglapi-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="042a63728e7518603f9436a4e069894347a742117f02684c3618c77b34160bce" name="Mesa-libglapi-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="457a2fbb0f603d08dd63a76419b597617cb719acab52c6ee6c9b4fe61e707b23" name="Mesa-libglapi0" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2f39f1082f76be8fbaa1dc90879e3525360dbe2cb2c825c8ef70ecf8060686d1" name="Mesa-libglapi0" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ec5ec4d9d82e43cd79a8cd8fb2e83734354623a4bba31b627f010d022f5822b" name="Mesa-libglapi0" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f3abdd24e1472df470dddc6791960cb6467b09e3f7bdfd623eaa37a425a1e5a3" name="Mesa-libglapi0" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ffc3232b737dda46df0f434a1b01bb6838d6a40a517997ea77d48ee2e2fa8ca0" name="Mesa-libglapi0-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b5791b2f562817a56544b95cfd7b6a651c3e1f85eec5b68ccdf61ce38fbbb4cb" name="Mesa-libva" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="139ffcf4c74ac6fe9e356fa40c651f2f806db1fd0fb9fe496a7d91bb458bb726" name="Mesa-libva" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="095203942b691f1697169703a0dc72d5d8d3326bc873bcc714f275f488a3fab3" name="Mesa-libva" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bd435faaa0acce4c71bb844f6abca64cd5a5091e80d17536340bf299c69c790" name="Mesa-vulkan-device-select" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="da317ed1bc412c7b4333be008bddbf22975e37cca3eb812d01502f68768d1289" name="Mesa-vulkan-device-select" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="6bf2c90cad60b264d9ae05459e5c35eebef5650305133e081051034028d1091b" name="Mesa-vulkan-device-select-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a71496886b894a9b1e8d9dee09e794cdf4d2588898a86b5658dabd28e1e3ea01" name="Mesa-vulkan-overlay" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="76d07c740d2189ddcb89124e156c7ebd5c19386c264610f143e6e745192d7ab4" name="Mesa-vulkan-overlay" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ac0da2ac9473336d6d9bd3eb99157d9458dbc05c28100b288fb2cc721c096750" name="Mesa-vulkan-overlay-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="1a426f997cc0168ecb250364fa6604b47bcd0564f029c7a96afae394fe72025d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="10c3b0c8f2f597d6580a54a4adda9bf9ac011410a30476be5929ab8d4453cdc4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="139d13b84200eaf590a3950ad9c9edb2f585822b6b582f183465546e1820c4c6" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="f76af917fc4c70f5236b36bf156fb77aa60f71407d84ceb877cd21fc0029dc13" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0647d6b6c26df1d92782e8063ff2efc261af7cb22923d6c7a0a57b709df0ef22" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0a867cc6fe29af059fd9a019b0a45371226898ca55f7db97d1da4f8d968b4e89" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="775cb5b1262e75054931916e6c500ed37ec763927d3d7637671926564d507974" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f85ff2fa61a348b098d2004d3253d2df409eef5a0e8d6d9a9cbc49d965ecfee2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="353ad28e5e90b2dc2ad00684508d64ca2c4dcdffce3c8c9e67b47162aaa9086b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="aeb0d4d06e328123cfd8d5c218b0791b702393a6abf48b00012cef6b28ef4813" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7a49daa1e8fc9d658bec6d6007882493f2f84c07ebb9e32e93e49bc17b8c151d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="7904db243329c0a7ea97887bee3327a4b510187178090eedd78fa95b60ed8a77" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="59201665bcd24dbfa2976f389a070d12990a08e28b25b5f0d326dfe77afd712c" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a481807ad7984249b399fe269ce6c8e8f74323e0e207cf4339d2c0cacd237888" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8e01671d967da6c5aa852661ea3b262cc93106425d57477f6d0628cac2805051" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6aed81613cc268499cfaa2d8eafcf38ce7ede2a30e05ab77be66ef6e6147e8cf" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="edb08833d6b7b3172078b06355e41fcba406482d0ce450669607c98f8a1f08a8" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="ff9576e06fcd06c95ac3eb9c5e9cd8768fc34b6cd57680822026f0d4608170f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="8720ee6b012231234a75572ba4d8bc30587fd05b0a070f0b76a78362bcff21db" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="82aa1f2c54e9894493af5c519b9531431f9627c6c20e62dee64b5e3064a792c7" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="7899cf42dde29671b0f1bbcf97e93a50aac6554b8bb837131d7119f3e0f4e661" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="c84884c56be17639650c6c42d6bdc7f9a9de366d77afa60c3790ec1e5735295e" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="f6a28ebbafaf2027c44126b364b25d2aa541642cfa1bdd2844677c3fa0cef668" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="5a5b498a25771bedc7d1b37c4427af807e2c4b2866fc78ce65331d4925ed11d6" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="aaad4457c6c40a9b3998fc89555507e208282a67e852e25c7bd567a958406e46" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="4c2f5cf1a835766c1373082c7d805b983b7e9dadfb8f10a813b050424d180ad1" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="485a8dca1e0329db306620a469d600439eb466c26aa958f331b819fb0f1fba74" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="0ebe1f5f00855a2028b953fdeffbf479002f4b612a8cbe71a6d11b1e79af0206" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="6059c6cc05ab6d6ef99519ca1d8b59a5af237ff62e7395852907986abef61d59" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="dc81ed26d6c750ce9bbd10809320e776d8bcffb7802f0bba2cd2f06dc2cd790d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="270b8fc6172e7deeff33e9622df85e0263b83bda866e1da1c159af3298dc11d7" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="3fdda60aa69e6a2af274deda5435c543a1a2256cc461d54266fe813c21797e08" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="2458764e32621ed6a29e7bb585dedf0e7a16cf37a482cc1ac2e0644ed20574c7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="f0908ad9baa6203e1426814262bda9f6f819593aecf88ac414860230cd760dc8" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="f855f9c1fbba4f877097eb58cb9b06c8853b550d2843b45bfdfc0f38750dd659" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="ea32895a01de8ceb5ea8c4194e59b6be53ec3e9d159c0105d773691415419b8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="41f7073a928432a2257e50c06165675f9d78de318cc7b0867e10f676fc8c416a" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="6b45e7ad4ab3936be2660cbe91b8a1664d69977a83b42699c3916dd4eb1e02b0" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="40af497f50d5dc13b95329799e44cd8e55aa6adf2f06c285ba4231d5e4090578" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="89781066e52c9ec590b0875f7171663351cbd6e6ff97a195a9dd7711a98de7a5" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="b85e361467cadcf523f8951d6f7a2e6e7f306a6c7c939dd46f8c3fb3042fdfe6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="83f3a7723396ac9a3a1d3408ae8747308db739af93fb87a480b720f043200db4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="8f9386806342bf0dae48780ad612b72c336ca6eb2f53f9492da6b55400e88d78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e8bf775558315696bef3a10d4f3b7ec7a0ab1850dad741ad6d898cc70d1ed2e9" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="da59f9ee39a57e3c5285e6e2d9359adc9e1b023672e15810ac1e41372cd8cdf0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="3cb4419cb681dea6227d89229d0d9f27b962b521c0ce8eab21f40682fb62a37a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c06b0bd51eacb622d196ef369f134bb8932ef50e8081e2babb73b9e7f3bb7c66" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="260a6f210b5c4ee33f04d14f76f43ab0491a2b04f3ae327edd281cbf3899b116" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="b4fdba3e5ac14cbbaa84065c49998c6fb4fca2112c3d1c822d8b1add032e907b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="76b5d8578d2785318c31cba6204c28323590e31e41be84513eaaec31b188697c" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="1987219eaa9398db524e2524cc97d528c172c6b44d3cf2a2667aa0238a8ab0ee" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="68470f9f9f851ed1b996496f5095190f96577bbe0d1e1d620250458cf2570612" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="9468e08a1ab795fe76ff9afbbdcf35d061a6369a87df74f0fa66b1546f3f5312" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="909f531a11ba8ef960dbbc09c17162377d474c80430d89f4f681f62d201887bf" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="98f328c0839f662a46b889a311faadf7676ba40a6c0910d3f3359cc6067256f4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="cc3fb2a401b3358bb2afc18edce736275c71933087eed77d3427c1338e316e8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="eb2f0bcf20acc560fef6197d849f3e28ade4d454f192d67420d5364190e3fa78" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="de6ed7fb46c1238e0e65cde8c3c86a2671a65c582af6cf3ac537138ad1c67e8e" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="068fc831029c6bf98c6796d621c92334080a95ed6da2b415161887183d69c05d" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="110a817fcce86028000c96e5e5e3764a9097c73cbc085d86efbc019904f1a41d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e25a71e060f8c0eff2dc8f55deacc1ac3fc02fa238e0ebd4357f484846a57e2d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f7d1493e9ea9b204541e47a8ac34c0e7a98696a0f3fe9135b15833ee7cb353cc" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f45c24323d6dd794334fe7a2227c4f6c0143016990045477bf3b827b9158a9e2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bc647fa08b0f842c6d050478b86ba40e49cba36928472fe705f10fafc9bacd05" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7786a908edb9e3efbc6cf8765fc86346ee0420e91757ae06b41782b15dd0e5a5" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7fc115fff90d6fb3af395e9d7d60ad3a4f88d27f0da2cb7f59d9283dff1dac1a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="97beed1d29098dd55b12f86be1fd9510e786528262ccfaa8a976e15a880053a5" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="7ec5f584e7660658a68422ecec882a26fe55185170c88afe59d533db6a460e78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="72201647be6506e5f93137dbe62aa15d5da9cd9d494c98995d9113fc9c20f42f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="01d27ac6b25c1558562856f550439714a025afedaa1f7cc4c332a1003cb2a317" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="538b96b349c6a7886c4a0af8edb9fd7e57277c8adf80d7806383ad834b6e449d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="d6ec812e31e6b251a64eab10792e30d21e113462f50b10f5c5f6fa954feecd57" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="967349f1c450209ee67aaf9068f56f2d9ed10753af986faa508dac6eca9695f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="b8c0138159e8c5a27f25a1ab71731a16dec64c99c54fbe6256c805fa7e39ae3f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="3a7f52e4ade10a16a015d416c7d73c6d969cd8e8569bc98d6c7d9943ed2323df" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="65bd1344de03179d30812b7c8180e3a3779c2bc9d5a0f9a9c57c2ae1708d6679" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="930a5dada857efe27837e9cce8e363be37fad2b5c63bb2de7d57b5fa273cd35a" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="ff50c022eed599e406e405f07c580d1f4ccb559dc35be25b5923ab88601696f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="6537f26b1470efedf6178d6dbad7d32c8f26d23e06eec168ea17249c299c95bb" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="62aac27c61f68d652d53d0c0fabccbe98467de2315db76f62d2861b8d8784e5e" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="1c5d56707348a984a8168e0fe41277cf16309f8ed22c8bafa88bf9a4e6b7b3a6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="4f0517d0cbf4716ac71fa4de88a767f813b620d883ea130406fb7de5130c720f" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="22654b18c51e6e35db764950d5a22bf09200d7b5ec6ca59248a1c27ec96598f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="d4aa4720f648b876a1a593ee945b89d7af1db5ee6f24501b07ae885624043fea" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="88281f8aa3b7bb5e596d20add1e14fc37141bf2bb406edc9ca54972e1cc67aa0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="0477d0046fc57f637d16a2310ccb38931ef5fb0b8a4e612e9f5381e4059137a1" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="b3cddf3fc0c80933f15de4717bd8a9aa21524ef1f267685898afdf4cdcd3f28c" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="a26b844662b746a9eef67741d4e47d3a161b69d6dd5657761e9da8b5c3da0548" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="037fd713393ac77457cb30ea23efddf497392587e5c5b8e630149259c1ca5c61" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="86cae68089914a10d71b7c84abe27484407cbafb5e9dc884ef627b08b8b40239" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="defcf92a0084d85f5dd4af3ea92696f00a128e294bf0f43f987687a345cee54e" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="7f9fb83576029cecb400004296c92bc0d15b3735f872c05cf9fec5193fbeccaf" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="1919b57c609abc52e2d63114b7896752f6eea7ccdd84cc0b8b0897765641d505" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="8e39464270bf78f067b234283337457b43717f8a718df537df74a4f73baaee13" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="b86ca59d1b9e3993b5ff4ae8f0ac64d77494b2274574991aa9b9cabfe72fef56" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="538c4a2e51c88f96c5a3cd369a0b7e8439bf6a305da73e89ebd9180a349be732" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="bd98db31bea793d79a8a5b6f989e68c710dc96c21ab3e1313d3e5529961281d8" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="2e5b779fffbb9f2c260ae3205340ea50e8a2c150253def8e8e5f7ea2e72cfa39" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="c64cfe47a44a77f89db9c8803d955d146d194411793488d71b28b865f178b678" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="12b28e5d9f5d3c10351a42e2dd390d1fafb1894e54ec0b46d39c0f1380d265cd" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="7850cce9851c3e620a59b5bd98e07c9d9c72d578f8f1d04f2390ba119619ebf2" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="357aa9cddffc634e7d8fbb8b8967a59ce99a1ca37c5340d5ae8889596f7ba1af" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="87d8d88ed77f8ef5dcb6da7eba6b0b329a33888cb2c3caa25b330f3baa266952" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0eee3027f7c24e8d8e6201a62a3822a9df250762146b49f6aca5b42c2e4a1e38" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="4719486ccda5367e999312d9a7577ce329e86d892a296d134f5013072b0c6f66" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="41106f4563abadc13a7077fd19df2a695f678465d59c9b502abb9c0c91e4bd6d" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="248d2fc5f5956361608a17fb292e65aae25754e789183c16848a7e5e8ba882fe" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0ab9603b60fd875b76ffd57facd7935293c888cf67cee988e18def5c667ebe0a" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="91b4c9606612efdc5507ff4e4a3982af7c03be0a8724c8a6edf40dacef09cf4f" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="2126cfe2663dd9dfb6c904ce95d9168b3ad4f7be27491eebc425dcd976d4c829" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="e2309de2757ebbfd28182f905e3b5912020f560b0b608d6c8a0343a15bd9c5ff" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="140" rel="150200.9.21.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724328000">- Don't do gconf2-schemas on anything newer than SLE-15</changelog>
  <changelog author="cgrobertson@suse.com" date="1750248000">- change version to 140</changelog>
</package>
<package pkgid="37cb44f00e8b43c058cd74c10e1c076cb75a34639ebd0481dd21fc162e444329" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="140" rel="150200.9.21.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724328000">- Don't do gconf2-schemas on anything newer than SLE-15</changelog>
  <changelog author="cgrobertson@suse.com" date="1750248000">- change version to 140</changelog>
</package>
<package pkgid="dfc97f32b5cdcf0c2bac7550470f275629632227639a9a867616e3824287cc12" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="140" rel="150200.9.21.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724328000">- Don't do gconf2-schemas on anything newer than SLE-15</changelog>
  <changelog author="cgrobertson@suse.com" date="1750248000">- change version to 140</changelog>
</package>
<package pkgid="a7ff2b8f88a8249dbe1884fb6bdf6c8cc9f6bd6eedb3f8f749dce814e98da2e7" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="140" rel="150200.9.21.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724328000">- Don't do gconf2-schemas on anything newer than SLE-15</changelog>
  <changelog author="cgrobertson@suse.com" date="1750248000">- change version to 140</changelog>
</package>
<package pkgid="9d5b686ea65296b7e0f664286b1669d068e56cf5b2e708e64632733c676b3e67" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="140" rel="150200.9.21.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724328000">- Don't do gconf2-schemas on anything newer than SLE-15</changelog>
  <changelog author="cgrobertson@suse.com" date="1750248000">- change version to 140</changelog>
</package>
<package pkgid="33ea4eb4ab51cc90961ae963eecaa892187ec3eb943cbba95496a29cb3eb8194" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="611d3b156fa58af24da069e971d39665eb79babaae1c3b4e0370817f46f85946" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="91a543f88528f1d35ce378cdc6ce8d23d92958dced46de37bfe9a9c20898a3e7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="7d54e5f452aad714cff64be8a5b8b7582877467dea14909f1a19a4a11baaeb8a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="ac98abf438179cc49f7ddb43e9d817bc024f2697b3d8a9355cfdbbea2a6311d0" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="c7735404599a515eb10598b5620230e3d3e02bbd1b2afd3e30d1455705d26984" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="64fbb23b27dd8742e673b32e58d0a57cc6937b2f3efdd9ec94fcf0cc522c2ab1" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="99c67e8d4e5e38b75659a393cf7db1c93bb8332def0b0da48ddb3bbcaee65e42" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="112e86ea6f2d7229f69cc0c044aed8b6565ee2ba64e110b4bf9fc4e355e2b3e5" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="5b298fe1e5133b6142903f1dc5aba903673a41fbb08425cc11631116a89946b4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="36a2cc8eebfa76daf0711920182b825804b6f79a1353c3c396df585680aab6d8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="14bb8185439331742af0f8d50fc55c7fac357f5fe8b3a1ea5d57a50e98701237" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="81e4f27f457283202b4686d78b0fa8e3c5e6dfc7adb6204982884cc9db5430f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="9480a328dd7fb1c2d3762dcc2fa64843062020206bb578a1c457bd481ff4246d" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="e01b0ecd7aaa609c597dda7ff899d7d34196b68b4f5f69018fdac10f93ac3c08" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a3e043585684ac6160ca22bde40d162b79510bdc0a1324554b8c012e78bd25fd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="f3be338a91b469d2bc2ba3ea37b1ccce147c49e324e2f5b42e036ef4a45d46f7" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="cc8a1f8de09a3094a50aef2b0b48d45b44388ecd9870d53b41e6cee1f1c64905" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="cd9cf39882bb0da573432c89d5ce38f206c7bc381d85f68fb730cf016b9aafb3" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="8cd7f1bbdde7e1e0132741e611c8f747404738de51da0ba5200c55e6a1dbbf1e" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="ac170bb4c046979f07902cc8f0ffc0c13de865386b60de74b5d6c24ebe1381a8" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="eabc479b40922d448fed2d42c6fd0f2d97d6ff855f2d31e77517e4655acb2449" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e990e29a6267f51931df639fcce2d63b812e64fe0ee9eafb51861cb0c1bf6697" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="644cde74b1c9ed81e2ce4bb1c3bdf0ca482a037c798ba97a45820a175cf4483b" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2d73eaa599767cd060079c1a7c9cd137ad4cea69d67de49a54bcc3a3caa3899e" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9d2c0c8f72b999fd416d7d51a38da2813df5d259a050399df1c325178a55139a" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="4422768288795fdf00c2d21e5c834ca3a375e708a2abfa5de8b55eeecc5498c0" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="40ac725ca4d26a8db16558a1e00f89425d78772e626c9bad6b51ab57aeef2ffc" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="ad82ea97a85bc43346ed6494cd9d1b98a856dbe5793ef0c4f048a964c4d70e83" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="c84b93b9aa7a3f2bb413e69303d19248b3e96f3ad0cd51ce42aaf6d6c3e0f63a" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="97426157b7c09a827459195ff2efdadec3c60169d8531c10e02201cea4c2e584" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="5e622e852991b26cf4e981ac249b964fa3cde83abda3b4cddd4ff26218e5ada3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="cc690b7af5446ff6e1f1b15281c17dac2a0f88fb8bbf2286321c74b2c720aa92" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="b4823e6fe75c49ac70dcbef73e53324071ea57f0b5e9de2e36edc0579dc05e24" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a9b8ca7ebc0bea744a0915b0f2d30ba8b79d9e109113c889f2d230381a2a015e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="91a24494421318cbef9d2b5edc7f54fa4bde259a53b27c161ce1b0d4ced9cfd2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4378559cd9c7cd7efe7f1520017c07d77a8f5f11792ce53123698f0b73121701" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9cf78971cfb6b5d404deb5da57defbff4f9a8724ba8c52a912e18181963e8d04" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="22615b53553f55077373cc9200d4164a0be73cca0b484f00a2976047b27c27c8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="03da73bf3b56935629e019eb45d4059da27aaba56b4cb2b77fc677be76805a82" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="0d0d206e6d3e4fdd7dbeca84f1371e42d9d0a49c68afc00c1b88972a944ca298" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="5658c893883af8363b58d5478bb41c31bc1763b271d3dec349de9712e4c7720c" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="a820ec74a48957fcfda79827fff135ec2b3ba36859bd56c581cd4e2bc0550ac6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="c445ab575b8e36665124fb64812ed11aacf6953c998456ab3aa3d346dc78fdc2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="93018e4be194c2e6490ec243781f72bbab6adf1e0dbcb4d64021003b9a00cc18" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="7eaffde8287c830f417316051656d5a311b33273801f4be28048ee67967ba4f6" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="498e74705ad42d349c91b58dd6def13ac3026a54858c8a44765528e4b48cd184" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="a91eb6707ed4742c65f8c201be675a57c8db4e76db17e7d67c4589f3ad960db3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="0de56cf849837f3bf8b0b0db36eccf9640bc3aa6e784e9508d150c9900cc22f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="2a74f1f9b19644e00b9d8ceed059b4a06a2e6de4f5e664c9546c31920d69ab03" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="9ac9eda6524d03a5370ae74b76b0480f5185ad9c2680ad144afec9a38c6fe046" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="11d9a007efd4c28eccb82bb50e1f76e006356c4f4d20a3dbd6f939d1d79f7d79" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="e171a275ac78264665b4c8e16f1436976c882f18a5f6ba1b42cb0dc8de01834f" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="43f23449c998050bc6e4027371793ce98041855802db1a0088ecc95fe2b96f3f" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="6aa98a07d3e0aa52f737c2ffac1f1fd800025b88e989357e6e6bf4a2a72395f5" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="643549872eb73d105747d488189c7aeed649d3a12e5109c81c494a85a1daf0cd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="6dd056bc7309aee600bee2e051a98d26d57cdc3438e5b14f6e80cf8343c72432" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="c97479875c0252b67b7795c40716ca9d41d69b3b6376c927293d0f1e1d0603c5" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="9babe40326593e59ed67fa1880ee297dd9ba2195af5ddd6e31bbdcc8916c41d5" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="a4995a8c1e8b09e8097b6589ff2f946f5386fb40789443905c536fc495fcf222" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="1fc7d93932b8595b558c4788be7b53f68167cf059251ba4cd60ac15ce5a73834" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="627ce666dade6b00a05c5bd51cb14b93ea9ac183d4bc8046e96c844d07a1b323" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="14439ab958219a6e302eaa6f0b1e4313b1e5a920a462aebfa2e26d0e50ee2d53" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="20004d8197498e46e202e893284584eb07b4da6412d9c28efea5e46b658e0048" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="e04f0427413a2e548e00aa67d136a68fa7ffc06fcbc0e9052d55e907ff1f7868" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="136ead731a8c4a444f05a96180b79f3abc4e2cc654a76219120176ffd4904d4f" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="34fab1a9531a40099a1dce992f137b5ba7e0e24b614814ef27873d8bf1bcc918" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="1c152ce9643354bb472d6d2223e931c3f8c061a3bca561b17faf910ea188391b" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="f53e6d81d448a1a3a8d80a98f65a1ea67edac3c0eb9f146bca344597463bbd7b" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="49af4c8a9d953cddbf92b15c7049699098fb8aadd5910c1daba76a0b9e486302" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="e6724f7950afb5b50d5a6707cf4ead45e4f1f45d7bed59fabc207ca4394593f0" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="cff0d5eb166982739775555ed794680af847ca6818bcf30c972dd0de5f945ba4" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="c3736a1e54c61d2090bd0c3d43b66e6c990422be111da66355cb3767abe74484" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="d04ae4c7502fbcaeb085fad01573266ebaff4b308121d2dee8bd4dc9dc72bf8e" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="5988c33a03fb5063af8acebce65bb161ba88fdf494f5f884bcca7b1a4db6d07e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="00339e24ed6fb9fb0d735854157baa3305410d8131d8d9282fb03ba62da19b84" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="f551e2614b11d6d29f47b54df9910ae017b9df3f9dd0986cce8f88e3705ebf59" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="74433d9630776eb7b0d46efb52399d7972e984b30c2a9c12ca9b84ba4fdd82f9" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="777068bf19302ef81643cf8c9ad34e984029ec2b4c0c73bcbca319741e7c2227" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="00ffca9df5b677331f97035ad15b141675ffb22bbd7d4732b369d77781bfb9b4" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="2df986d3c29663c63bd844266742980a304098879109557029c5babd872af10e" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="e5cdf8e54a7b6a05049f8ee16fe02fa1c9e89779fa1a3b19ef77b70c465f0282" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="23500b50d732c37447e3b25de15fb7220ddae1d0d972cffebcd58928912ef19a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="56b342e7749fc9690b0ce8c09ecab820df20587d3fe67ac3fd1d77baff945c75" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="d1060d724688373302d75ad610d6352054e6357a673ad387e13114764c870818" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="4db8aad0fca0e248d69a4d06a1a78ad8fc328abf4cafe929f5b178fa402b2ccd" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e21c65a7016c1c8e5e38af04478a8d75b2a51b7cc58a4b758519fa7b2f61e8c2" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9b36b325b3be8a435555c0c131fa94c915f3494440fb41d7876db7c91e59f177" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="990dc4861f6d59cddd454069399bc313b20574639ad22e80e6452bde481dd87a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="1b6c20da66df1297a939f22c745a14f1ec16ccaee099dc8e7ff7b6aee2774d97" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c97ea79717d56c307ddd947ded2a75ca7e648cf21d175429782f64e4b09de286" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="39764cb75416421ed9cd0d05632bb4ee3b9d49ac941d3a9af1735b6d2d87c6ff" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2d66b1fe6e1e0c24d216c53a9a8ea44eca5a34d54e5337c91b43be0609138f15" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="5ba196d9ba33a252c610bc3166aaaca681c7da48b6524d2eb1117ab8d7da6caa" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="52ed3a67329b70a1f5551aa44d7597b2d1b2f8ee5465abe9fdd91b234ccac211" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="e0e711df89717bbaf08ea0e478d79f355675ad697c36f7a3754145b32bd461ef" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="9ff813f46b213ede00a1a27b21db89e1367e87764bc28234acc14148d7b0c929" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="db6bb0430a8ce14a9d94c0c851d9cc3f9e34d4f2a4a98962f909f54c75e32e39" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="c794a6e13fca94b32388c38b4eda6eaf1a1c0bdb4af7c2a9046852b0806ee9e5" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="a597465e9cde5084036bb15023d1da8784fea5c2ad114dd67dda46688fb5f0c0" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="b619db515a9f17f66bf0c897a81b3ccd1c3f19f03254f7f8ee754a53c2251b32" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="72e8de1214271dd63914b16455ab6e8fc8a6eee7b449ec230a077114e5ad023c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="38c9b6cec1929bfa81e25b6d12eeaa6405027a5b92ea1f392a40f4762f7a59c7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="4c7daf43b9dd430d737a5c2564e8c985a72dfb4c5564f57d40a9f21888768b0a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0b4abb2816b124373052d1d6b8370136f6ae87e194162da8bce34c01b136a5aa" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="625fe220d319a75461d51aaf1ccb606910ebc642301ee863a613b8b6929d52f8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d239168a9ba82d08e37d384e2937a5f3efd7d4de49301d4d8c3cd493988b1185" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="b6b3147537ff9bac7ad826e834a5f8e88e832d056798e04878329d4adde0168c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7be8cfedb8b1891ed42e6e9edc80c94982c0fa3db960939974082b24cfd516fc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="343103d1ce481d13ada5a84673df6c3e154a1f1fea776f97cdfaa6605a09cae1" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="268f2255b7c2e395e1b25ecbe5bdab4172fb8c3ae1f58caf32db467ad4669e12" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a221018753aef499f70b3f37547d23bd2e46236038685cd9fc42f5d9640bc23c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="9710540ae59d3159ac72b55a0a73529b0c2b5bc6cb0b64e171ec2eeb796a24f4" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="40e76ecd4d8bc783882587acd620fc87b7ecc2bd93539035e8836bf6b8d15585" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="bd46767b26ebc0f6dc9275acd67dc3aeedebbf011ecff08d0635a145ccf3a533" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a5636e2df779e66cdcf6b4d4c925667bc44eed34474c5ce407875627734eea4a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="7119001074f088b1407813218193b24f988bd4e6641a21fde73bf118a3a2cf11" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="eedbb10b367229e376c08727a103aa664e96f4df1b044d90458255c02dff3efc" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="047913f1e44a15ce51a3753abca639cc8f4637a3bb749407d77d85b117fa3829" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="ffbbdcbd1ee0695a33a0f3e83adb8b6769db79d020ca7a6bdfb02b75b8aa280c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="76b33371d774672c5a51ab5178a026eac7e341889907026d8fb83e99e16a8869" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="8e2309f36af53fcb1a838d64129c87507815b3e28ee0542d2b7a9c383cb597d8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2d9bcd26697bd3aa57e913508a949d0ad7f2e1068e3812e7b1d6ecab285751e7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="b154a0e9a8660149caa537bca89551e58ee77cd257d8eea67e5d7324c199e21d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="960397764a546af62a9b7a9983bb55e0dd8e71438a6533db602454c7066b1389" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="03be066b61589e6f48ec02ff1718bdc59b90c3e78cc4ecccbc2d7f43b48c3fc7" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="db76816e21bbaf72b52c1dc04c240f18eb6418ab16b64183349fc9032c5f0e72" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9fcf40cc682e505cfbbc2113ba7cacfe9e00cb14fd842a00e815786c0099c1c6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="a3466919a2920ff616b96ec13d02844e401dd42bcb8f33f5bff9bae32635bf8c" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="51608ad363fc3c9827d5d00f29e5f90d6a430e36afa00043bb2b98de43ddd031" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="c776897d9a233005846db9df632247b6e5b04b64932489dbc647e961df4232bf" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="4cc817d3a854a1ef95a02c93279c9b820e516501bb0b4548ce047bcc8a0c2c61" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="d45174be044d84824d20415c773ed8eb06d39c4510b0f9bc6850d1504ffebaeb" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="c1b479cfe8898cf5b0e5cf91df10548ff94f422ec363af1f2adbbf5a833ab969" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="490998741c59b4fedf737d778a9ee316ef61907bd58f8d3e9d7c4846c3f0dcbb" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="49699b1877940916c9b22eeb1f22dd4eadb7eac8748b8a94e19ff603219a00b4" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="98b8d0cae6f24d37b82205357c013e2b46980db20b83eb8e4f3bb834ab861e41" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="beaa18d95f51a6c0c6dd01d6cdc0bf496a498fee0572f9bfa606cbfe7428479e" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="ac7c3c5cd5139fcbb5f6ec6065d2f6c293099b65116c46bc27d58e4f95923f3a" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="5be6fe5f1369b7455580ad3a0e7cf4c3571779b2c1d04f1fea509c4f18f741c2" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9ceb17fc8f10dcaa219d17becb8b0b8be409b65aa46f1107e5bdc074b3d21a7a" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="fa0946741b16e4ea7109f674e86f188bd60d94623717410caf6dfc9bb2afced3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="55ee3f11f61e2e7b06a3c3a000af3741e6a68abab41e1a3cd23d91c77b8ba490" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="655a8bffd2b7d3d01e048761c34b6009d130800e11c8dcf51006d5615ca23699" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ff88ce2f291306db139d24ffbbf656011fdb1d28fa33752b2675e03f39029536" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e798a5fe5e158fdf479ec970d07fb192d15aaeb84cebb29bc97c47f9dd951e1a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="b9b38c60ced916fa7baaab7c8db25575252dcccdaa7508ebeef68ef3de319560" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2ccf250117e076e71bc0a7282511be4eead3e2b40f6b4e9cb1dab4e6fdea08b9" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="9cc114302ca475194eacd30c57c5b1e43a5754a059145442625cc90575e7c5bc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="887d1f49d0fc9dac0b4769b541d4c57268ca2b2320dda71d15bcb17669ae6895" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="6123a47d5655bd9fe3ca0c7f33079da23557bce32f8a17df514711b584bf819e" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="3af5d9a94ca2cbcc929a6789a7a32810d267a0d8f93a3265b0f72b531ef6cbc7" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="c879de380ef4dcec2ad35ab21abb2f2569c6c00b4dbe50c19ba1d4bea26c68e8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5d8b9f52e76efb05883c2841671ab5538efa200e86c9abe9d3f23ef938c5a1e3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="9cace12134e3e161691bb0bfc53188d166996154d1a3c69278aa112f3763ebce" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="525be4102969661c20f21317982da035e4cfadbd8752dae3712bc13eab59a8d1" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="da6032fa65e0df2ef2608d065f626af25b4231324679de1b4a30044511e92987" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="5151b9f5f0628c75f41eb1875db7ab13cdcf7d92d729afef555de85a80c7c369" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="d6133a2579f251e5df075ebc3fd5037dbf56a779902b8b756d7c3c42b2d270d9" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="256a454b2b5ad46051cf97ce4f841298359a8e98f4eb55cc9a1bbc09380633bf" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="a09e90a2b68a6d178de7ecd1df020598653430c6a4cb8580a3290248329e6a37" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="81dbdd8c9e9891a46b76a9a01ec0932ce7c413f75cb064ea4bff47dfb0f2532c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="17551445ccce522d9c2fdbf3c25e78642cc6f3771b7188fb6193bd5fef6f4086" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="adf26721295bc2ced17ea84b4fa2dcd86b92c38047080aeb7c6ae8c631d2db00" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="cadd96b12ed3ebb4742229616f185feb4dec60b43eb708734dd2aa3474c8a9da" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="157729dbf6a965d54a85ff305eadcee044853084916c01666ceaf371d770b984" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="39b772109c464850915ecd212546a011c11ee970c5e88eb8aa25e378f021a80a" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="8f5ac6051836204a8f4457fb025640c2087edd025f4eee837529f4e9fbc1f0c5" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="9a35014d0999bf08570274ecb41ef6d529e90701f7ccb6080109ae1ce0395c53" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="147c224efabee109d19ee4c2b5d288afc65878cf2ef8304d19f891278a141b5d" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="742815a5557ac2b2185a06729106600daa4eab73dd6ea8ea6bd9cfb57217c946" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="793d47abe06d4474ac7145a29a13df0fa77f171bb5c414cb9093b21c5ce0442d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="0312f8667d4316bef371a82486c95fc6e0b37eac58048f45caaec8386c0d8b5c" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="f52ff0850a07e3ee49f1cacf96662da1275d7df9cce81d0c51ac2d659a5305fb" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="67c76cc587943ad928d174a764fbed3630f64a1d78b2e3a08ad51ee901c27b83" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="eb87f52d6d830ab85878aba0bed57f1d3dbbad4ee0d222b05655005cdb14068d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="73140b491f3333ac1934d9cd2ff1aa9d96daeeae169ba3ff0fc32cb827eadf2d" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="2747b6ff4089022f489727cecf97aa8097f0f4f48bc3ac9487d63145ee0839b4" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="99fe5b9837755486770928700cf6b6123bce04019a6fe340a642d2f2aecd9018" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="409cacae9760d8cc79c56ddb24b9a5316b403b25048ade791eb9519846fdb22e" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="4b59cc95780769fb8004993d76d4b853b43058adf680257674f06340823508fd" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="bfb9fea274045ed018f8019213803cc79fca5d309e94dcd31e7cba0ed1afe0dd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="82df70694865d0df0a215345b32d14bdbd5c036deb02592a79a9be0fc93e503f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="08c7580f7f4800d5f75ca922eca9e9b480814c47d7c5a7db0c22d1daa91cc349" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="13a5cf01a896d0af22c397c7978dfefbd6e0b5c47da5ea2fd965ed364b0d9532" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="72967cd2b217d78d02c6305ed0f22a84e80591973cbad7a1662b65fd6e2c4026" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d64997d19bb0561152de9d518f4a5d38f998f007857e56650aa60cb4661b2593" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="0ac18b62f170b14e4d2d4313d9e6912c0a484955477571000a37f7e27e3e227b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="a97ac27ff5644473a34e13daa5fb251176b50e14f78bf74d49038fd0147aec68" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="da21f420c8cf8b86cf69eb05229fb25e08ceb1aef97a2390b404c13fcc161ae4" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a0cae92332a81931afd18a80e68f9a5840e3613b1113abc069998e2f812782e5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8b635114da54b446d4693e758a1851d30742703ac8651ee0fc551fe182b7ad83" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6944115dcb4b6aaa8a221dd4ff8616c84cf85a7889f7a0d7823148460e7aa8f5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="fd668505b6057cc86b31dfa3fe7390c6172ca51efefe931ee37070bb44407fd7" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a60a5cea901cb80645967129d9a7cf2465a339368bbbdd85707eb26a24da58ce" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="415cbd152229a6bcb3ee1dcb529e8f67664b4abd78a44116dba9f4e5d14006ca" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="2468340a570ab0d3baca1048a90d42f68b82ff05087cf776ab38a8badb0f2c47" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="bb577b9a4eeccff07d1de6b8e739f1ee4e65b4614e717432f63bf3d56ecbde8f" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="23125122503a5a31500092402c8c80a094553c0a563315d4c131e989c9cf08c3" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="c30bac4d088e6bf1e194c55d97b749d6122a1219d9d7884ef9470368dbb0d6e1" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="04fe6742647e51cd5e081422ae2e54f008b7a441352bd15acffe74f5cb8abb1b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="267494bea152c08cb53eaa1c29d44c19812d68d4c6461589460af3df34cce6e2" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="b04fa186eef4c6922159a07bb42ea7411eff9f69c2e5d2bebf72874172d88dbc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="61426b6e4d7c0175468e9c4781bac6bcd9cd6a158942bf0ace9998e104c8c097" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="6323ad55b33feb85743ac2ddf3fdaf20097d242a051dbb06323f3ba4aea9d3f1" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="d0a26883fd41506708eea7e874d6e88eea98096641fa85d12e49acccf8e178b8" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="7fb518381b156af1e6d214155e1dbaf17c9ebb156d350cccd0b5ea666f2ac9e9" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="83f803e3a19eb21e8fc73002644e11a87c202990b48286c96960d4f66f372189" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="47ea5cc0a72086598853e50158538efe9568be223a8a7714abbe2de8c194fcbc" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="d70757fabb42b00a16f36995d8ef5ca6cacd4a385079e0cd81bdee9e2ff5c31d" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="8551622a4862553fa6d698cab53baf5a2763a699c60cf2ec1726e714cb77572e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="7551c34b481f2707869324851f73f6ca1902104691aa2e70fc6178c70eebd321" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="0c12aeb9567da70ec4a7cdbb6ca99e01fb4cfb5e124d166f352fee0970e03ac7" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="0cbcffabf801a49665fcad5c0ffc82f176ed5928c169a917d8f1da57f4313ab9" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e627135f7b7dfdbdde39b152e5b960d8649b5b47cc8d3dbafe56eedf6b18ab2c" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="80b1af2e7b84b2bf9c80b7676e0da031ca594d8d285dda038b939d43981f735f" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="aa7672a8893da6d0094933260d1d996f8457cb3e7ef19184ee75d586ee37784c" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="160d9d66aba543bd9e7c06563ca658a1725d091b0421d2cc3aaa548026d41688" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="f43fd26c1331db3d62f06754033801f422561804ba17174724e8db11e7f8a6d2" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="abd75851c87cc60526446ccffeaf6aaaf969698b198b965df98c9d1940f9d973" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="6fa9dcdf36aaa0a8b3566fd844aa2286906f8096c56ec462161be4aa9599da8b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ed91b2c165171242619debb02b0be6713339f5be6a6ce9c9c2b1c563729fad27" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="090a425d1292b3d07451c35fce71054b70b1b5e18fee7221dba32aacf50120d4" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="3f21ee8e9242ac9cbc6e8d8ee03ae6e0e761242e509d6450f03f0cab9140b432" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="eaab9cc8158f595946a7b85843ee05cf9f7e775a94e46212393d42835be1e0f3" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="f86c008eb0b5762c053ebf08405ec777f52501e095321c5a2ea535ff28ad6661" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2b9705f242cac4e3471a6be0eec51c0e88b16337b5572527fd88d8ce0c7c9706" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="35ef48302caa31c2b58fa9bc71302973628db2037d8efe1bff2a8a35aa68f2e0" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="72b6d6f4597531c0b3aefb740438de5908ad96ecfa8e0f269e0828660c42aaf8" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="0a029021b178ea58bf77a51831ac154cdb3a314a1edace2540cf4a57b3d74dcf" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bf2e830ae09742cdb070a7c4fa66c4c9bae575e456aa6001dd23c9cb85a66246" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="ec647722f42ee15d929273c30116443dc587051efee489023eac711d2818dc9e" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="82e334b871736e59a86c024b6d3211d10bb27f85c3830fee92320a9c8f616a50" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="55735ec474002d058f136546ec6629f96e26d67234eb39a12eab173475734b46" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="c8b9fd7617347d4dbb63c9fd1d5afccc455fb239a147d8bd9f6c1614175f1f9e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5b804eadb3ab98e05fde8bc52da3c20c4374a18f8373e2fc4f887a0000a6bee3" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="c21fad3209b97e210aa84b898cf56b0b39a08597c86eb1e82e24bbe16afac2b5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="be525cb2322b0d65b2cd5076b53c47209b86dd823aecafb7c869c9d008746a22" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="492987a009c79db24d727d5123eb126b730f3b1a7776049dc83d29588d79396e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="c6c68f942933a7a5055c8c72673cd90abebc427b8eed1b78a840bcbd30eaa2f7" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="fb6c4fdea7de6b85a97de0750dcfe041f70c9ddff317492328d3765d11844c66" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="d2c99c228efde1e85c73564448a4e71713c8e27cc36a08e3ab031dc9d1f1c44a" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="244cf265df887beda0c517f0719bed26e1cbb86955b97fdb4f34b6f68b759cd1" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="44c25ed9338be30ce755401bba73ebfd10a0912b377a9276b6f3d75ffc4b6500" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="d8efe2b9469d5bc8d76af928fbf4d51cf90eacf03ed1c529c357cfd11f9375f9" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="a133157b04241b46edaf9b0d082fa5a04ba8de09f96e485e38f267db909df8e1" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="aee864b5d23f7dbf7043f819dcb8b172527e4ef9eed7da4ec5ec2c5100cef819" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="8c4869e23a7b22b54789e0d335d3c73aeb48fc9eee36909a444c00fdf7820cd7" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="94aa26d2f9778d8dea3fe485e0849a322057c9ef6469d252669c06e1745dddbf" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="66b261de8ed7f5846d0a5d88db84db05d922caae9994d1d1fe6d07450c2adf88" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="8a1d6b280fe364ccc8acc5c910bad9b28aba761af04eed5396acbf59ca5303b5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="c7f220794b4f47b7e265465fb7db974e7c9f72beadcd511a3d1eb9964952363a" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="6c67f22b370eacccdc22ca30effa28952dd49212003d820d3b624bbb9465f579" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="5e10cbdea525fd4d76f3138de13480a2416dd8ad4c6be2091210758113afa24f" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="46f669ef3c9a06977818c06b333f338b1f7155ec7b0ff579a5f830f03c0e3a17" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="c336f14c1116da3f21d567e19f0f6d8e669a37dafea5a4201b9a058c683dece1" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.152.193.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  Placeholder changelog-entry
  MFSA 2025-59 (bsc#1246664)
  * MFSA-RESERVE-2025-1968423 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * MFSA-RESERVE-2025-1971581 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * MFSA-RESERVE-2025-1928021 (bmo#1928021)
    CSP does not block javascript: URLs on object and embed tags
  * MFSA-RESERVE-2025-1960834 (bmo#1960834)
    DNS rebinding circumvents CORS
  * MFSA-RESERVE-2025-1964767 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * MFSA-RESERVE-2025-1968414 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * MFSA-RESERVE-2025-1971719 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * MFSA-RESERVE-2025-1974407 (bmo#1974407)
    XSLT documents could by-pass CSP
  * MFSA-RESERVE-2025-1808979 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * MFSA-RESERVE-2025-1970997 (bmo#1970997)
    Search terms persist in URL bar
  * MFSA-RESERVE-2025-1973990 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird
    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR
    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141</changelog>
</package>
<package pkgid="2fde59408dac3e3d34c6d76825f5a1d9390772627deefb2391dcd698f64bdaaa" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="52a07ed34d8ab12afa8840d5c37346fc8788a4d449adf809e0ba18c081456950" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="6579717230fcdb2db2777307f1f630e2873a88993be34d748768488dde2e2d1f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="bf1f6194de6236cef4c587622d6af399493bbf4f096dcc0fd8aa1bf1a3fd59ba" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.152.198.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-53 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161601">- removed patches firefox-kde.patch, mozilla-kde.patch,
  fix-sle12-build-errors.patch, mozilla-rust-disable-future-incompat.patch
- added patches mozilla-bmo1746799.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1750939200">- Firefox Extended Support Release 140.0esr ESR
  * General
  - Reader View now has an enhanced Text and Layout menu with
    new options for character spacing, word spacing, and text
    alignment. These changes offer a more accessible reading
    experience.
  - Reader View now has a Theme menu with additional Contrast
    and Gray options. You can also select custom colors for text,
    background, and links from the Custom tab.
  - Firefox will now offer to temporarily remember when users
    grant permissions to sites (e.g. geolocation). Temporary
    permissions will be removed either after one hour or when the
    tab is closed.
  - Firefox now includes safeguards to prevent sites from
    abusing the history API by generating excessive history
    entries, which can make navigating with the back and forward
    buttons difficult by cluttering the history. This
    intervention ensures that such entries, unless interacted
    with by the user, are skipped when using the back and forward
    buttons.
  - Firefox now identifies all links in PDFs and turns them
    into hyperlinks.
  - You can now copy links from background tabs using the
    tabstrip context menu on macOS and Linux.
  - Users on macOS and Linux are now given the option to close
    only the current tab if the Quit keyboard shortcut is used
    while multiple tabs are open in the window. (bmo#None)
  * Sidebar and Tabs
  - You can now enable the updated Firefox sidebar in Settings
    &gt; General &gt; Browser Layout to quickly access multiple tools
    in one click, without leaving your main view. Sidebar tools
    include an AI chatbot of your choice, bookmarks, history, and
    tabs from devices you sync with your Mozilla account.
  - Keep a lot of tabs open? Try our new vertical tabs layout
    to quickly scan your list of tabs. With vertical tabs, your
    open and pinned tabs appear in the sidebar instead of along
    the top of the browser. To turn on vertical tabs, right-click
    on the toolbar near the top of the browser and select Turn on
    Vertical Tabs. If you’ve enabled the updated sidebar, you can
    also go to Customize sidebar and check Vertical tabs. Early
    testers report feeling more organized after using vertical
    tabs for a few days.
  - Stay productive and organized with less effort by grouping
    related tabs together. One simple way to create a group is to
    drag a tab onto another, pause until you see a highlight,
    then drop to create the group. Tab groups can be named,
    color-coded, and are always saved. You can close a group and
    reopen it later.
  - A tab preview is now displayed when hovering the mouse over
    background tabs, making it easier to locate the desired tab
    without needing to switch tabs.
  - The sidebar to view tabs from other devices can now be
    opened via the Tab overview menu.
  * Security &amp; Privacy
  - HTTPS is replacing HTTP as the default protocol in the
    address bar on non-local sites. If a site is not available
    via HTTPS, Firefox will fall back to HTTP.
  - Firefox now blocks third-party cookie access when Enhanced
    Tracking Protection's Strict mode is enabled.
  - Firefox now has a new anti-tracking feature, Bounce
    Tracking Protection, which is now available in Enhanced
    Tracking Protection's "Strict" mode. This feature detects
    bounce trackers based on their redirect behavior and
    periodically purges their cookies and site data to block
    tracking.
  - Firefox now enforces certificate transparency, requiring
    web servers to provide sufficient proof that their
    certificates were publicly disclosed before they will be
    trusted. This only affects servers using certificates issued
    by a certificate authority in Mozilla's Root CA Program.
  - Smartblock Embeds allows users to selectively unblock
    certain social media embeds that are blocked in ETP Strict
    and Private Browsing modes. Currently, support is limited to
    a few embed types, with more to be added in future updates.
  - Firefox now upgrades page loads to HTTPS by default and
    gracefully falls back to HTTP if the secure connection fails.
    This behavior is known as HTTPS-First.
  - The "Copy Without Site Tracking" menu item was renamed to
    "Copy Clean Link" to help clarify expectations around what
    the feature does. "Copy Clean Link" is a list based approach
    to remove - known tracking parameters from links. This option
    can also now be used on plain text links.
  - The Clear browsing data and cookies dialog now allows
    clearing saved form info separately from browsing history.
  * Translations
  - Firefox now allows translating selected text portions to
    different languages after a full-page translation.
  - Full-Page Translations are now available within Firefox
    extension pages that start with the moz-extension:// URL
    scheme.
  - When suggesting a default translation language, Firefox
    will now take into consideration languages you have
    previously used for translations.
  - Added support for many new languages in Firefox
    translation.
  * Windows
  - Canvas2D switched from Direct2D to a platform independent
    acceleration backend on Windows.
  - Hardware-accelerated playback of HEVC video content is now
    supported on Windows.
  - Firefox on Windows 11 now uses acrylic-style menus for
    popup windows, which better match the operating system’s
    aesthetic.
  * macOS
  - Added support for multiple languages in the same document
    spoken in macOS VoiceOver.
  - The macOS session resume feature has been enhanced. Firefox
    will now automatically relaunch if it was open before a
    system restart, like after an OS update.
  - The macOS DMG installer packages now use LZMA for
    compression, reducing download size and installation time.
  - Due to recent changes in macOS Sequoia, the shortcut for
    completing search strings to .com addresses has been changed
    from Ctrl+Enter to Cmd+Enter.
  * Linux
  - Firefox now supports touchpad hold gestures on Linux. This
    means that kinetic (momentum) scrolling can now be
    interrupted by placing two fingers on the touchpad.
  * Developer: - Firefox now supports text fragments, which
    allows users to link directly to a specific portion of text
    in a web document via a special URL fragment.
  - Debugger log-point values are now automatically converted
    into profiler markers, making it easy to add information to
    the marker timeline directly from the Debugger.
  - The Debugger's directory root is now scoped to the specific
    domain where it was set, which aligns with typical usage and
    avoids applying it across unrelated domains. This builds on
    previous improvements such as a redesigned UI and easier
    removal of the root setting. Setting a directory root updates
    the Source List to show only the selected directory and its
    children. (Learn more)
  - The Network Blocking feature in the Network panel now
    blocks HTTP requests in addition to blocking responses.
  - The Network panel displays information about Early Hints,
    including a dedicated indicator for the 103 HTTP status code
    in the user interface.
  - The Network panel now allows overriding network request
    responses with local files.
  - The filter setting in the Network panel is now preserved
    across DevTools Toolbox sessions.
  - A new column has been added to the Network panel to display
    the full path of the request URL. This enhancement makes
    helps developers quickly view and analyze complete request
    paths.
  - Introduced a new console command `$$$` that allows
    searching the page, including within shadow roots.
  - Improved support for debugging web extensions, such as
    automatically reloading the web extension's source code in
    the Debugger when the extension is reloaded. Workers are now
    available in the Console panel’s context selector and
    breakpoints function correctly in content scripts.
  - In the Inspector Fonts panel, we now display fonts
    metadata, like the font version, designer, vendor, license,
    etc.
  - Added support for the import map integrity field, allowing
    you to ensure the integrity of dynamically or statically
    imported modules.
  - Implemented support for `Error.isError`, enabling brand
    checks to determine whether an object is an instance of
    Error. (Learn more)
  - Added support for the `error.captureStackTrace` extension
    to improve compatibility with other browsers. (Learn more:
    http://github.com/tc39/proposal-error-capturestacktrace)
  * Enterprise: - The UserMessaging policy has been updated with
    a new option to allow disabling Firefox Labs in preferences.
  - The Preferences policy has been updated to allow setting
    the preference security.pki.certificate_transparency.mode.
  - HTTPS-First is now on by default. You can manage this
    behavior using the HttpsOnlyMode and HttpAllowlist policies.
  - An internal change has been made to Firefox that removes
    `XPCOMUtils.defineLazyGetter`. For most people, this
    shouldn't matter, but if you encounter problems with
    AutoConfig or third party software like PolicyPak, this might
    be the cause. You'll need to reach out to your provider.
  - Firefox now supports the Content Analysis SDK for
    integrating DLP software. For more information, see this
    post.
  - The SearchEngines policy is now available on all versions
    of Firefox (not just the ESR).
  * Fixed: Various security fixes.
  MFSA 2025-51 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6428 (bmo#1970151)
    Firefox for Android opened URLs specified in a link
    querystring parameter
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6431 (bmo#1942716)
    The prompt in Firefox for Android that asks before opening a
    link in an external application could be bypassed
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1751889600">- Replace usage of %jobs for reproducible builds (boo#1237231)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Firefox Extended Support Release 140.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-59 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753963200">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755000000">- Add build_limit for s390x on SLE16 (bsc#1247774)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755518400">- Firefox Extended Support Release 140.2.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-67 (bsc#1248162)
  * MFSA-RESERVE-2025-1979527 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * MFSA-RESERVE-2025-1979782 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * MFSA-RESERVE-2025-1933572 (bmo#1933572)
    Sandbox escape due to invalid pointer in the Graphics:
    Canvas2D component
  * MFSA-RESERVE-2025-1977130 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * MFSA-RESERVE-2025-1975837 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * MFSA-RESERVE-2025-1976102 (bmo#1976102)
    Spoofing issue in the Address Bar component
  * MFSA-RESERVE-2025-1 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * MFSA-RESERVE-2025-2 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="440ab4d47fb8d6b106da36b59ad4c2cf18d39264007bcafa6e170450b35f8049" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="2785706ed159bd4a84889ab37e9879c68b9cb74d392040c9a1c767c725198f5e" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ac60e564668ea51fb5d84baacd67bab08ff315d1dc707489d05400cd08601937" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="edfaa2767cdae9e9b162e73263517d8dc08317fc6db149703dab25f2de08640c" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c72d621dda3b060679acc7ffd2858ebfa85d9f5039690432a6658b2139db9431" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="4af78d4e6abb584c16e73d7fc18ef4258d1ee0751e54bbc814ef879d09e0338f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="232f22c91f9550b3b2d049b1b04367650551c534bd9ffaf66473690162b4b5cf" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fef1f673a8f92d9e63713d45f6ba3f24f3ae6b0bde967ff4320defebae369c4f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="be7828a2e17adbf4d8dea4e64edb01d97368814e4b90f9aa74c19889cde42fea" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="5a2ca8f2ea7bece457e36e5052e363111fda2f942e1a1fbc48a062ec4da8e2dc" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="4aba2662d9efa6b8cafd8adfed9c158e733e4fa82bb0f75c80bfe1771973ce94" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="080854a29d57db54c8055151076246ee21f7aaa0a89f1de7f19bce45b723e55d" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="e832999c38909ecf7c7d4e9c005c0b08530b64dda69657c243b3f50416468260" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="166e1557854f6883148a1b23e07d919bc66d6c0e66ca4f29b5a989a4973c7d24" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d644a0bb8be1de8ff8a175dfa1f20f87ef49912f3022a62b4e48e739d2aa6a0f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="5d31fda063fce4355835f1a910c1f118bd92fac47cc6900c7d564c5204ff980a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="21825a5d9b0908059ecfb37722ff11c0c8216ef84eca2405cf369b5554d55d98" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="46b3fffe0d1ae59a4141aea1f380a4b7e6c959971c859ba0663c1dfd9c60de2f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="1fb033d19af5bd3e7675b16a16017f2d4dc813980ca72dc93e6f85a66cfac1b7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c63c404542a7d4967c5f4ffb0ed0a98bc2067afddd719598a5e0e3800722ca50" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9039191fb4c8d842c321a3d138d6eb8cf74d19fa84e83630cc70d00ce57aca24" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="67a8fcca46fbf7d7e4ebbadafbfd3f9434b7620feb26fdac8af7a1336859e406" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="30eaf460c6701b109f4b59446ebd503f5c8a99b892f3c673d557b182dcb27090" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6673b5fd73ff6c8e244be8183fc5ea13132f3821c6d968f8d7702d6d1412ec5f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="eb2823755635b6647febf2d5636880e4ee0648e89b985d360f5aaed5a4ae4faf" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6701d0913539cb64c56165e383b59c35d300e90454eb744671e53eebe4f9d7fd" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="89fb85373020f91aae11c1313fc96bb686c6a293e590d108ea82261fc9535060" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="ff137fdf06d63ac86da09ab200a285d1ad4609aa571335783d370f15241f2e53" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="9f6c18182c560b07ca477e978868c33eaf20c8f85c8c0ecc85ca3a3151c9aba2" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="8c08f6875e40817c53ad780b20141dc90569341d859666872ef0c8d005760491" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="f346e16ee13e725fd9e42713d276294386bf2d067a3534424e968bf748cd3129" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="ef2c118657ff40459034dbe7333fd463a40d3419ad5089da9408740f09362942" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="20e6ba66069f3ec8824dfed33449653bcee0bf20b6109dd09f659f28f28751e1" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="bfc1cb40443f265885a0019e99eb2fe26d63114dde67b64fbf745548b45a3810" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="9f6de43fb5e9450dbc0f892203b0f18d837619cc36a1d80cf2d66f8fe3a0bca4" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="423cb32ca19c24416e3533f962b00aec34cc838fab10185d13a0e2f414a5e7b4" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="403ac34c179af912aa8b056b868cfbd2732bb5e4c03c8cc1aee3843b68819ab4" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="adfb9846cba6ef2bf15ef9258d38e2365984a47abab2a2386d513e503fee65a2" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="d07ba3e869db22a3bf765e79a3fc752d122f5eecede5546a8d005ce1db27141e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="7e6f09e20a10e302064c31209f270543e1baf60114246fbd7c3708e5000ad99c" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="100e199207bcfc9e4b2d70e95ab68044a872187f93cd2856a67ea5945674c891" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="91e43bcec3dc9fce3554dea0bba85513bb6003c4d490bf2598c64600c514bdf8" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="19e6679df2b34951d930423137c9aa06e6a94e54fdf010bbae9a80ae44083c0d" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="056a6bb7c98a1ecde1b8c779a43b71f20c9940b9f2066f5bdd77385de18c5a2e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="1b5940c22e1f439fb71453bf74be92c006af563a26296ab5127e8b32894fb2ef" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="6129233ac847728e2a5727f17eb7e87fdaa83ffc53dd025d963968253bb2586f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="914ce31b709852127b5d418dab80e50197b1f4dbb825aec2e1059258c015c3fd" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="b4fdc3290c0220dfebf9ef010090a997175dc93b41cf8024837b7b62fdbb692b" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="3e192d647b85f8d640adae9018e78562149c725aedc8ec377ca98299b42e5be7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="9e59931de179f46d817f9eeb62f4b040d29f73afd7263313f777dcf1df66461d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="fafe386eed03fa0e90080bb5b6b9af836b82eaa4f7829fc5cddf549fad0fc175" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="80d6aad562ff3e3104434b80ced32b19129190938dc48551b69c3f41dbe5df62" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="1f656fce435fddbf419d4db9620e29e8a8044e31e0066f5d8e47a1d982f295d1" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="8e65d8711855e43451fa5d81a7d23cf13e9d6dde5c293614bfe0b6539262f33a" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="945912d6e6a929de689089c5fed558006ac1da00e79cad0a3d37b6e70be5f9da" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="f8b087a9e5cfd3ffdef9919d36c1e52141c8bff86860e2ecf9666cb0fb0d7aaa" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="5e5bb6da4d5b120950040a0524497aa90ba27b60ce5fb0c7d831cf66b2a965d9" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="23f10f140c1490f58a5ae851d38508595c76bb1b514b21d4ba5761690e84f357" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7b4c2bfc9e276676cf963013acff63689044c8b0080631a02252d3fdb33a9a55" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="9252adb5f9015fd1272cf40bf5aac0bc93401ce7ff67315e22977b4f1361b0b4" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ba349cf0068a6b51f9a817e629996db54b41203dc519b93e8aa7e9f56e7c55fc" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a8dc4061b9d9539ec0127d9b27cb3cb0a2399a3a7175a9df5ab5c6ccdeef2554" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b3e490a0730ce7c509cf9579fcc49b89f1a0cff1aecf623da18107d933ce79e9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a9b6e34c039a9f99b451eff57d8b66987eb3597be6279a9f08422ec1a7f3d242" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="e6b16956208cf5423b0a882fbee5b3efb0bec378cb5577405d485ac2a78c45ba" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="234313cef37630c6c3358600585089166b3c219c8cefc541a4a1fac5a72f6e7d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="efa4482675e99d92f7c911d7998446872e467ed1d6114f6356e35e61f6ae7e8a" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="314f75dcceb101d98b3416a17bafea7ddb7d32dde28c590406fca18c27449134" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9ba3776caf6e90e69dc0ec4f5ac0b51a10105ee3f0dcdb64658c6fa7b2084346" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="c66ade353bf974a6b53df2658493de3412a116a2731be2a153eafc0a4ce7179d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9c981842de1e4fdc9539bb3db12d0aab9c3550dc9f8e7e31216bc31797b67f4d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="da3db84fc84d6b1a138eaa80a751c844609869451a4b15fd0a965e988b98f5eb" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="e38346ab9a3d2074b15af67953691b9879e0dc7247010d7e1b0a0d198f999b90" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="92b543ff65c805f4a2e255d4f5bcbb4e507f7066d3b4278fef642f429b2dc53d" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="b67e09ad92610442508254fec9706db6c7e530cc88922c9d430a7ed787f200e9" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="a2d9a8a7957be49cee5ca4c63ba331be73a4567b68ca58e25f8d6ba7e1b2c4fb" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="0c2efba0c611f63f8d3666d6dc620b561d7a40e652f27f8df8189bf30213074c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4cb03a83b0852676d712cb1270c71aee5c07a2752f342a78236d12ab5fbeb6d8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="b845adca41f605f61ec3f8366760fb4b09786179baf5fa5d7f1efc086dc797db" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="37325beac5605a8efd501a114a3cf9e80917ab0dfe651e45ff99a6cf0c0755c0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="bf4e36128c3480a0a09ce4f95cdaca338087b8b336999e3357b07f0acfac5f02" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="e3f4dd5827f1203ea2ffc1de25b4f1e0729a25d490115a9506589d9e3161d97c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="04c6baad8efefc96cce30af21afbf6e597d7a172d088c262846d9d0fe16553bb" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="bae2ec24a4914049ed27f6366b24ae6da3ccd21d1b0d13f4045444e7b1e61841" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6de88bb6dc15fd73692e459a52bbb8b0c5f23edf84f5c0c959b13cac0a73bb19" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="7896379128381de5addbbe97f88ff671b6e7c7ef30dec23a9be1e1f67a000eb4" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="1b95392fb5d59c925b2adb3ebf52702f4041f46f658ef6bbeaae8d59eb8cd8f1" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="e4a833efe0b37248a6a5de36d2fedc29bd65ec1c6c292ef2d15ec8a749586aed" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="fcc5fc4aa7627db18a19b6f61837c92a2e9d6adadf2dde3f09b61986ae397bbd" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="db6aa5c43339c469c67e7c7e1813b9d9da5716181465a20817a8a07e9acb30e6" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="9aeb35fb9e3160382e50c9d674a6d7f5e73bada9b7e4d1b33dab50e546e01196" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="671fd257ecffc64ecf98b2422b56560df5b2c7961c14c8f3e763ca3665de3667" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="1027e1a8e4d8b8105902aeeaccd557c4231a735ca98b1dbc31f1f8b85853d6b9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="ad05db7539eef95359bc90ecc831c5e22f70bc79a3e3b87cd786fcdb0f5eff7e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="903bdea0b8a0e5885f3e66876e431f2d4b79ea475181cb19662deb0e117712be" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="803f1de0819392c05bbca0ffae4b6794e87907b19b8b22dd1c25175acea8c2be" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="34da3f1531be3006a261d6b4550039a2c19bdb802fe7a6d68cbd63d2c139e0f3" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="73f2669940149b5a67e40577495a3ecbd9d81e99757eed7e58db1b92975feda0" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="69aef5192740c965b1f0e1da4876ef02cf0755a2c5bacbe127fb8364ab55d5a9" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="8ee789dc23dd76984dd36c187472cb9ad60ac3ad7b193258f119e9218b9c4a6f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="e2060b22688b256f5d3aa775000870a3d89149f2732e5ba94616f5798cc0277a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="c49c785e8f052a241b593bed61bb2d0e62cb069a65c34b8c4673a50d86973dad" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="cea624ca676c98078058d2b2cbb44a2568a3f6172be44853507f728ec2286005" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="946955dfb1d73e933488c908df02112bf27067fac1096fcef13dd67eca93ef60" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="94894bdc6a5cbd2b98fed436d177e66c182fc09a9872bf000b2c21a621184406" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="38f5a6bb421d62d2f5312833104925ed502f262023da9b2b23fe28d3abbf3243" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="56cb5b602145db22d448daec2d362354a078bfebe606ea91f1929e5c261715ba" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="2e85b03c032fa5c6cba7e7f07d715081c9c84c9a636818c82ae62740e6d97970" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="cde746560740702dbf0dbea0ebb0cda01495363b9d57951b6ef876159f37dd30" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="b98c0c6b9953655b26592a2c014f39f5c8a9845c6ffa9743a5e400ddc97e44c0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="2f71046a740d6280cb417ebf82f557220ce894831e4b5a4514780b66467cce53" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="4863a7b07ee0e3f30415c75289b7c7b71d39697927aa8c3fc0ee126865e802c7" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="27d421fff736582c5e8d157d5fdf47ecf4a1ffc65a115c9caf04ac9f5d611624" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="bba6e8162828df98685270cff13dee51c8ca888a0d0da486bcd65ef0bc29323b" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="d05f87c18c5a52444c03c07950267b80ab25d85155c82ed12e2e786ccf96b6ef" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="7eff0c1a35715e8284d5d521bb903135e42bedc1c324a1060aa6f26037106ae5" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="10e6ce06a6aab1ec0e082c5049ed8cf0fa87bd7267fe8e2a284136489013d784" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="6f201a4b702947f8dced3670d2c6098e322e5ca597fea192eade93cc29bfcf9c" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="8e8c4cf3f547b6cd740132e2385c8120b707eb9e495e4db07d6ce8a0aa2e5e5e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="71f1b012915ad80637b4f35b07ac5134975636a2c449323748385b9cd5a15c29" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="be52644bee182e6a19ed71e324e5ababa6226c0f74e032d8c25456a8d7d82fbe" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="ef7b69d81c9aec059b47d952f920d6a4afc92d468110c6abf393d835cacf1fb3" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="4d8b85a08c8a2ceb711332e244accb17d854d2d1301ea69dbe0eee392bd23946" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="e515a66e2896bd5081571a23510def235a4f5980ff3b2759ebde8b54cc129640" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="810b34dd73b1f7e44e0f1e62a1260248c64ac9470d169f1bfa6edf4d5bce6fd5" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="3f44fe92325e27326e5e5381e9793704c716bfa8f458b79bb0daae3a64c81036" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c74846b309e7faeca7d7743a7f5ee0ce82732e25595a473db5bf587eca2d0388" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="64076a3397953ca826ab59864999dfff79de447bb7df77f46efaa56c922602ca" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ad20d9314a9fe71c53998a8c7c5211ac74a4a5c2c13c1f02f2c324d28a114f61" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="94be601d129dc8970ec4b926b83e0e9ee911b2783aab87e43dedde4d6194a9c1" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="523ab9217c8743ff8460286e27dd29ea35be4a651c5102e0474e14335de1a591" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fea3ba88a40979e4479b90fe92ce6b17307c4439a42a8bc056c7fbfa3ea80559" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="02f4ab1bb8c0e8f81b3914efcc7f65af1478e03377dfe739391728d3d8aa7a0f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d49c5ec1fb4764a960a30d2a1e1aef53998de5f08e998344500697639f1ea7b9" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a2b2a1e0838837b666f0002057f5ca571c4f35a87026320b4932e97575dd8fc8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="42fe4dad76f7d27d578cc475a9eb196e637ae3536876a11bb4b28ce76ad5c054" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="928c05317251699f5bb2b857baaaff3260cb694eed69dc14fdfc71b439fd8831" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="dcff77240f40a6dfd4571554b96753885c32044ad4c5e671e2bdd240672a8fe8" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c60c358e1a5cb6b92529cab5458c6b86d418c1f78fdecb812faff0d3b7871cff" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="a464c1157c1102525077dafed508a6bad2b3178456c6719680e126caa3cbed52" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4ba9235621ccaac76f35971503f88e6607e1fe897dc817d6ddabdc25dc983b2f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="647873670a57858b2cf7e06a704446854e3ec6d3b8ce617a2ed87225d8ae1c0d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="78e6a358661d7bd74c5cb40c91d74b26dd100fd9e04a141b3d1584cfb61d7ca3" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="04a835b71a0b92b9f5391a65de143071a01d77645721cf74f748adbfc167d6b4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="f9ba4cddbd38e31ef4633683f346c2a77545791d47f23e357872a1cd2af11fb8" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="dc3ea009c0e768c6d2864af57d22bf4160d6c57d2fa4b46bd4ff1546fdcc8a35" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="9e73e14689f893be9eed9d746c4c082062eebeac0c670d19c4fdab8ff8d6627c" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="53d6a74c748b467d996355847093d38debf8287f129f441c91e94e15c4474810" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="4699d799264a80dcda7e4f12569a1bae892c50fb4d8127a3d6b35257bfa67ab3" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="a534fab89bcb779d6912bb5e25eabbf529758a2a9d4950844233b0b806a641f6" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="87515c4f5ff0f07c8f3268e935035d06b0ffe40f704d1c8957eb0379df34a9fa" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="5e2dde1224a101ef325649a33145be4b9d4fe9bab8c4f799be9092273e7e6ee4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="bc08fd745a6ea8139bb0cc0ab0af18f49242f69e6ed74e95134bdfcd1c6510c0" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="14d8de17835b7eb6219168d8f4513df30e287c0ac24d9b6e68a6ce493c53e352" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2657200e41400d8445d967afae2877974c25a83529214e259d10439bf2f00f5e" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e313137e974c103353dd2121f641cb18e418d472be73a7e2909c99743d2ecd8c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="43b10e0414135c3ce0b2051b2814a33971540049ccaf7b86f86eff0cad427500" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="18aadca824548bba57ba374c1bc7635f13910a85a0fe3bb77a1b65522293c116" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="0040e920e06669c4d8b2043c9b2777634fc8c13cf473728b6df059365893e045" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="04247b360ca0bbd9402fea50f5e9e7c609744a774b386b31d2f5a0f9b89350f8" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9beac6c0325f20f9e752e8ad587263ecf78579eb3df17c861a29a801c2b8d57c" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="0b4ffc86f5b8aee6a756190de435934200ea76683ed84e688b4afc3b4ab0a968" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="bb6ca85d9f16c872f6c8db552027dfe295f96b901ebe3529d73f63ef5af1e49a" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="7d73c329ef94778ce3f2e4e427d978e3a96985b4b859dcd104b6d8c8fc719b25" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="e43d1248b9054f8685ed11b415d27354e4024a23a0cac5ae4e05f615d7290dc5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="b400b7d64cc2155fbc45f8068a9ff42da13206be3e7e83fec07c06fc8bd28e85" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="7901fae5ccdbb361bd35610a861222e8213bf72fbab02ba73d33edd6b323c04d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="adeae89f214350bf6d93072d31c12383de239e1eb7f5e2f7e68550e9878f6af7" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="2c08c079a3b6c56dbe0af16034482bacf4a7020297a2ab1c449fe5feda1b82fa" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="214a0da621d83927d9042c1895f51f86558f8c7f107a9809da454edda58c3d89" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ccbda10e37ff2fd9332890dc62e2371079b3d9087e2b9cc8c2e32fd8f43af5cf" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4d99a02bef15f74485521266493733193e991776bd1fc315e2b2de832ffd05a3" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ef77477cde6d333127494acfd785314c2a3e30de232b9483f551b33216fb2dc6" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a71cfa141c9490ad1a18d1488733096714760be6f79a364eabd540a6ba42eb7f" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="9c7462289b0e1a9bf65de9dfa95488864595a89ab6c45d5ae6ebe693096091c5" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="d2df225ece7cd5a39d7b17aa440bc0e5ca2e81a9ab8669321d01b7e14160aa20" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="f0c8566dcd94c932b120fe7cdb677fb4c3531f535e1c7fc41b49f8f8068a8695" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3622f05fed9d72143aed35d8f43cacbdc1a50b23baa474064f00eba48a79fae7" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="27d809cb2e87e1aff4593daae09ad185ba0f3d595eae685d71ce59355e655a7d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="133503f0aa9e0e3f2ed2b2e1e12eeafc9e5fd7f234eb2b043bfcd029f75a06bf" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="8469112342027edb325146db3161896f07a3e8effaefe67061c84b73d45708d7" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="4644504eb28a6c5c8de5f12660ff2cb132e8d0b97a34d10d338d84b5850d1968" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="93e1c3830100d4db11c00bf994629ff15ff484b9728aa45d178b51978d78e508" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="ca96cbd18b88cd2571e3d36cdbe7abeb59a80550e1f4316d4a55b51b57d1664f" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="dd52d46c6d3cfd476416df1aa5aa47c13be5cf60ffdee448d832ff3227cd4c50" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="313acde4dfe0743cd354d1e1eb3420846ccdd8a608cf9a86444764f74d6859bd" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="1521dfbb8654c1ad3927547a1e3ebf18ebda8736f05cf237a89dce46542a18c6" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="5a1044222cc67fe18519783bd795171a4ced7382149311a32d8171e2476e9db1" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="13b2afb6813bf22e89d5f93f653115287b6d0fd02ff81599d5125f63bb16b2b4" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="f91afd25dc53f0c69c0dcf1ff61e29652a99975c161b159589446551295bbd02" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="570eca1092259e90cc31487df8095fac4145cb4ed3f6eb92fb52752ca512bfa9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="11292ed78e64541cade9fbaec9aa58a51cc67543dbe89b1df7b9eddbd85572ea" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6f4553b83137e3e9b68cebd399d3d8676b41b53bc319bd5fcb1bc553a5db415b" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="908f1b65c530386b1c76449ff89c2e520eedcdcfc1893d682a5ca42a41a7b0df" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="4db4520f46c087850b2fd9082cc830c1088dee26510f033f11fb214ad5417a09" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="e89dfb6fee5afe89ed7d8921f8b4aa3a2fcb9fbfc0cb554ce65ca4b3b26e4719" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="b87e881efa6b369aa6206f843e31f7f0c4e65ceb24928aa6940102387d932cb5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="718ed4c862cba2e61159d7ce07f607e4174e3c161f18ad2eab24f00d88860dd7" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="27ec78b0e8f0d08611cba6a4b355b8b3762b2d96dbd0edae0892f5c06e3c4ea0" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="8fab05ac20f99e22ab3ea3063800a730367d6bb5fa3700c6d5b992b6f18258ef" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="e4409be5a934e6c65614973cc67f6a87b7388a937508140c493aecc5ed97a8fa" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="e440f3c04680768dfe0a9c272d738725d94ad417ff819173956e17ed6c288aba" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="205f5e440d8bfdd8a909a8abfdb37606638fcde1020957fdfb2bcd3a5666e553" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="46c27ec40f1f989bb6336d35aa0771d934b0e1e71ce55272f7a7bbf54f648850" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="cedf80ca8980e7e3c42c588e2e4e06e4d4ff0d2db7e52f0a133f37e398f5546e" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="6bf4705d51ce3754cb7584e69d019e8dd066cd47b6876a13e2b5d1fe9f20ab05" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="dc9b7bd599dd6f2a659b85105d85cc194d01ffa9d8b52ff1431e54f2ade529b2" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="aa94961b7949858fe93c8c31c6f9ea60bad55bd515fe8e5fb2a71d52035fa5cf" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="e513113b27afc527105e109374ebda4f7648f6ce30e33f44e44c48c41b155fa9" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="811cdcfc97e2e00841488d4a1f0c3b53a7870bf934f2ea482c11d85f85972c4a" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="ddbdb4f69ec6a69d22d74c8457cb7e4579a5bacc457ee44588a108af33961960" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="884b94b2ed18c730d776ce5c1ce07288d9a87acc49a6c4582a6ff3781056b77d" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="8a32b6cd4b6346dcf725ae8d1a094eef74abdf43f8de7609ee3bb92c7a9a22f2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="167a8a799b6f85e9d2ff4a9f07665dd1196fd6167ea5f0f693f7d77cf8145c95" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="bee4ad144eeff23fa15ad615639a1d75fd136ea251493c015dfba8fce470efb2" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="8485b311c685e0e6795929786307ac166e1a31b55a2c087055afbe7b5115d2ac" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="a06da251ea93e1a75acf8ac5a962d802d19598225155b4b87fa119cc0efb2a42" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="e9877d0efb6be0db1c57e0587f90ce3e72bf9b55620ac447daa567f803c20037" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="cb6a90fb82c2df4cd65ae66156eb4a1db71432ca0c834b65ac78605036624fe2" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="8f73d23ebaba03f643deb3c8a5251b844f410d0cffd38cc84419ee67aabda25b" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="a90a4d203c7d35844cd7b83a542af84ea84c983714fa728ee129911ba806be0e" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="2b834d6773bb20e92055b2a7572d224f2a3cc9507508b8fc11cf62c3e527b472" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="ef49b748d367c73744abe1fc8aa961529aaada278a7186b4c8c5e9fb780d03f7" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="ee5db16c40cdd95d4a58af860f248575abc2966a99e6f2bf5f29a9f8c8ed6b98" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="6dc9256e76183807394610aa7e56e19d00d69cb361429737d3fd80568382c03d" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="410455ed2f22d520e132a09c5e0f65804672b4ba91db8c56f72dc37158a2ec81" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="3c2d5385fde8267598bfabbfd77c39c9839eb3b9cde31590ea27fedd3b896bbe" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="135596aeb4fc2f8ba38e4b3b088da3491f867bce10179a3f5101eb637800e33b" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="d8fb293e575a312d6ab96fcbca0cfc2c51dd12fe82bbb33c870adc29b98e787c" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="20a8cf32718ca23103e5f1c6c89465ff01ef430f36fe181ee0268ede5662aa60" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="45fd419bb9d252fc163c9ac1e5bb181bddb4faeec255125a803c185dc72ba28f" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="21c52ccf028c1c2ef5ebe87239f0bfb1b51110582d15b8633357946b2d78f651" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f4a640fd0acd0fbdfd627e6176a3274b8fbc584ef9a92db5020e61fa54e52530" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="3159158f038d2abbaa90b069b5620630a5fa7baff5b105c1572d3acbfc20b2bf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d0f4b7434ffbd84248b2f11e18ceac763cd8d8cc901e4d5bb6a974ac6d54fcc6" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="60daa90f906ee457ee3d2921a256401b34732e575e07a55cdcf82a6654f89934" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a51a1693b91e2faa114a147908440f69e0fb480968eaffec0a518c932760acc6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="142cdb4975184c9765a7bc9cc782d9610270c7c48808a1cbc3da0230eb51c6d5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9621a1ff7b1b5f4821d3749e121fc98efc6b988502d71f1f5f63d36d77c417c2" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="b53c073ebea7c065b88fba5fedac4a46c67126f58367350a15b3b595dd4719ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="15753b06659fc0e2705eabb37f6797d279c31e62d0b5936d99f2b5d3a8d70e50" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4638f9901ff553819e75fb62b2d761bd7ab91067356cabe0630079d6fb1f3e41" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="abbe1b40b59c89c1853c2808eb339537b6ade7b1f49b2bb374ea22e4945da315" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="83caf2e16a98cffc22a81c95caef2f7ada3f25628425124f9c160de5c83d3376" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="99986c7e90ceb72eb8f5dff86f9f94d814ceb4cb0370cb8972bd8f46c1333cad" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="efa7ab95cb93e8c13a7d5f2ac3e9c3c3bf600b5727e025707e391a71cfc6c352" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="ece72e8f4a78ab1dfd73cf6db3017e6f8f4117e6adfa9507229689cd4ccd23ac" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="f965d6248ff819194f3409b4f87491918894c24d73dbe8d75a1c2a014fe9f261" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="0ac7837f7ce5892d72f73798a24294003f2e116c7187b81a66f84475f9988a98" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="c71479edacea0959c1199d24064a56a127d668446e616fd4db21590987dd27cc" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="95af7021a74ecf7e5e808ebd7fe121d5e31e489606fc9919f76d5efd52e6c8a0" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="59c2889b14aca27e0cb0a707bbb217a0c4d5cd87d6a314fb1bcbed6d58119eeb" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="0b28138e13d473799bb5978e10dacceed254ddf3e60a77932a70e1223ae4bf5a" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="d8f3f3d3df6ea4b1e54e90867f899b1abbf60f3f24a77ba3086eb6a6c201db5a" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="0a85dae21d66543851d3cf7281128dda64c3fb034b7fa7405801713ea816bfec" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2a7cadaa2fa973f2f9b1e9499e7e95ee43fd97fac6717b49d4600bbbfa886423" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="1ca71d72831a5a46cb896b40e060bafe23d53ad090ad6f715300c7d84ff1cdbf" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="02f7d8fad9f4a11f7b56bf8a00e0b9f20ef9c11b07b63c8eaa04e8dcfd1563d7" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="2ecd5e9e7f6b421de719bda8bd0e88ee7d09236a564f42ed5fc61826c6faf178" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="19ef6482ff480ab1f42f878a6cd4bf1eaed90fe7f08902281756a3f2683679d7" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="e69850ac4e6cfeda6d463767a29448e3d3172730348688cbbaf97f2b098fc217" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="7c68da04b782b5c15891f8b02df118323a3bd629a9a8ef4a53a7805a72cd76cf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="7fd58a3344a5d55dde9b1811530b9421a8d8dfd0f978c492d43e742243421b98" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="d0da3864efab925ecef0d73e7e57044dba9190e41a9736103b00da4916bd6ea4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="acfdaee1fa5f00f558ef303b142f641f43257467a451d038e6937c1e80604809" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="43ddcaa478b0ba42abbe513d414987eaa1ecced72bef1a99e3148ebd138df90d" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="47b252760c0ddf48547b5d5643f5903ed0cfa3ffc90568e64144da4559ae1962" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="e8f13c277844694c1cc50cfb266c43ee48a5fb1132671252e31e501e3b36a3ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="fc2733d6d0360aa3d95b577056dc8a2129f9de9d93b110181b482d917c6dcabf" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="066f8e26b643b1de8518e3ced43475408ef88f9e248d0da89cd38b3b8d5a3f13" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="50ade53510e6f20c9de1da26e085fca095b8fd5702f7b28d10f707158e4250cd" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="f2b6a645fc295225ff971b0671f00db72c25ec58bcb58b92c6f65df9db4f216d" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="649393bf08c76b08d4c3cc331c66755ef458ed5b57dc774f61aec86a90639e16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7ba8860ad13f6319855bdda02c36e6c51a83fc24fd6e5369dd551212e465d19c" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b2f04beb617b202dbba04074249d3415f5861ad9b61ae9e4094d80ea4587f901" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="ad20095c1461103cd063277d0748d4edac8ef51660727d01910ff2d015b5bd7a" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3fb4958522bc82579d77e0215d862d5282ae3316d565068e8b80ff4c31cc707a" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="5c2eb89e797661e3d4e2b28cb7f41db8b573f74969e135f1782f56e7ae3a0ae1" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="ecedee9caae6a5d61e4e42048181e1c33e8f83a618d2067312dd79b5741a7bac" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="149b0ed73a935cdf917976e7f4e150a33b26262199d223c108dbcd7bfead0fa3" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="0b1d900fdfa2ed1e843fb01cb6ba0372b6f64e792b42af325c5829e2268add68" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="72315177033c0c635be40c5b9df1e6c1f5f57ecaa993feffbbe0b34fad407969" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="f4c07f7be7b3234dd1852bf56321241b08c03ca85f7e5d711cba55354b8f1115" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="38c11d5c19ecf6b711f2a11a2a1bf920408aa909096761dbc2c94e88540b4c42" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="32f3fef0dca2bba05cec09ac5e7ac9527dc2005160eb0aea65e3bf494b365726" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="4c7d22f5edeed3b6a509c4934e2351f98927173fda7627374832ca4ec8eb05b7" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="640cd434233054502393dae349609b0527abf00f47bdbf90ea3e2b7a782acc0c" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="ef9cb766a4625e3527918bf6fc9dcfee691f4ed5a064fcfc58dab4aa3718ffea" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="d4e9440848c8a969d6634dafb350f1d8c233dfd6e63a6bac4918df75bb897d16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4b030a5d6980ba2bf86e06fc75859a60a9893be48ea9cd969f6b8e0f0e115fad" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="d0568340928240fef88f8cdcfc5cc3c70931cb401efbee8d649952405a866f04" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="756b6a58d75bf228e8f097b8039c4bb4092d9b964df755a12d163e720c72e3fa" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="0d809d5d8467795e6e228977e057fb5e687b282aaf2dded5520114ec5935c296" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="4b5da377b4dd0a62fdd769c850f1eb9f8b7f2a7aee0413be8a876969469d43b5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="7e5c56da2dbd3cb38183953891fcca90abb08a6c3ee42eef37dc5156b4450035" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="afa8dd80f12d5052299c3c560c67599578efadf8ab2ba4f621c900bc53bac9c0" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="4a9405291d7497544cb759c073cad503d6540240b2f326ad96ec86254d84d2f1" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="97cb06e6f566cbec4f7d3526dd77fd35c400cbe609fc043ce494f2d67d62de64" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="a5ccfd8cbb0c91f4759628f6dc13029dc076e39839b572902a802861dd7cac30" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="bb11e0add6639ede07f0f82098a62e60d4ea73aba7610fa59c1d78c56f7a33f4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="a86d288f70160b3e0f23d12dbac98c18c5248696e4a8fd29b81a37fa14610f5d" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="be99b235b2cc0ba45c38b3d7edf209895db83d3e3df239725e8ab9dba0cd6e99" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="d403268bcc813c47fce98e91feb4f851f852971d99fa1429b3a30bedd1c9f1eb" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="0ec86b17eedf1c384e465e3c22b2beeb4923543f8a95c797db396d83a1a4487c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="ecea00debc51bf87db87ebf1a392ce5ed23ae56cc64fcb69855f98eb04483ce4" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="95f8c41827814dea08c678e92f58ff5366e0dc7fb9d3d4d0e7d6f75f55675c39" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="37da1ebe672fbf27799656f0a40db6e603071737bf380b5975ff884e8cb95094" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="832cf39f76a1dc024cb698e23b17c27cad2736547665da23943dd7feb10618d6" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="7c4cd48f334ba203dcb6bc8d1cae0050fd79bbab02d01e5c42995a6e151fac96" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="c6d709e37cd3b396cd53eb1ec6432e9fbce4587c4049fbdf6041bb35e13f95ba" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="b3331e8358f967503b753610f4dd16483ef9a3aa522ff99197a0209fe610c7fa" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="bf8dacd1bdc6ffa69b3db55892c7d2943e332bb1667af70f65be3a0b3a32d410" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="216215d2fc4a06f79e5d04b064978b5c688e6af5f926be68d4118d512e2830af" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="1f2dd644959a6fdde37ab4c276b44539604d19e5550ca97ef5cfd54c83109c2e" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="8c5224df4dec3d0bc93feabbb75e07af54c8c2d2608670c765e6defb8380ca63" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="1d5b64f4bdcf44cf3b68fff5cd7b8d5bc15bfb643bd78714a5b96386fb3d9f51" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="e8363563c4464c809d142cbd9790c882351b42f7b41e7c870be5a7e40afed48e" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.230.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
</package>
<package pkgid="57e118534d053831426edcd52548652af826eafdbaa0fec55f4ead21eaf290b2" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="410e3ff7c562f6fcc147ecbba07d8991ffcff5bbf0d29f1f83b843684e197ece" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="89bf773048272ee8f5a34677e9e7eb1fdf635f5baa8a7f1bec2e318643b7825c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="c9f02b430ac0d8c11be4d101fd99aa3f96f5a694b8a65c0312bdfcafae16ecbe" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="140.1.0" rel="150200.8.233.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
</package>
<package pkgid="334b676610e682a9e2459ef9ed755d871c74d4ed8a2d1574acc643c2a129daf0" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="0f827a831038b7d3abb2381336b3d1d5f23eb49243cfe25316afa8a5f3f8747d" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="8ecb6ebd5f334ce970e1c09823a7320d08151db98c1315229825fbc1a55785b4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="326a8070bf1cdea2e113c4f2cfc9a4aab8d09f7df8c8462f4525d953b4b9f3c2" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="140.2.0" rel="150200.8.236.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752753600">- Mozilla Thunderbird 140.0.1
  * fixed: What's New page for 140esr was not displayed
    (bmo#1976080)
  * fixed: Status bar showed previously detached attachment when
    hovering over a new one (bmo#1971603)
  * fixed: URLs for hovered links in status bar could be
    immediately overwritten (bmo#1947026)
  * fixed: NNTP message pane did not show network error page when
    network was lost (bmo#1971542)
  * fixed: Inserting a link into an HTML mail did not work as
    expected (bmo#1975621)
  * fixed: Autoconfig no longer handled 'No such host' errors
    correctly (bmo#1951827)
  * fixed: Thunderbird could crash on startup for POP3
    (bmo#1972546)
- Mozilla Thunderbird 140
  * new: Implemented enterprise policy to allow granular in-app
    notification control (bmo#1950887)
  * new: New mail alert now includes message disposition buttons
    (bmo#410338)
  * new: Added 'Mark as Read' and 'Delete' actions to mail
    notifications (bmo#1953662)
  * new: Added 'Mark as Spam' and 'Mark as Starred' actions to
    mail notifications (bmo#1953661)
  * new: Support dark reader for the message pane (bmo#1715361)
  * new: Messages are automatically adapted to dark mode with a
    quick toggle in the header (bmo#1942206)
  * new: Message filters are now available in the Folder Pane
    context menu (bmo#1845206)
  * new: Added horizontal threadpane scrolling
    `mail.threadpane.table.horizontal_scroll` (bmo#381821)
  * new: Implemented customizable row count for Cards View in
    'Appearance' settings (bmo#1865057)
  * new: Implemented ability to manually sort folders in the
    folder pane (bmo#1846550)
  * new: New "Appearance" Settings UI to globally control message
    threading/sorting order (bmo#1829737,bmo#1943724)
  * new: Added checkbox to select/unselect all calendars in the
    calendar setup wizard (bmo#1733959)
  * new: Account Hub enabled by default for second email setup
    (bmo#1968292)
  * new: Add-ons: Added support for specifying a cookieStoreId
    when creating a space (bmo#1913580)
  * new: Added Thunderbird-specific loading symbol (bmo#1905839)
  * changed: Removed obsolete preference
    `extensions.overlayloader.loglevel` (bmo#1901705)
  * changed: CardDAV address books and calendars now use the same
    OAuth2 code as mail (bmo#1927998)
  * changed: Display junk state and allow toggling it from top of
    message context menu (bmo#1923391)
  * changed: Subscribe/Unsubscribe buttons were removed from the
    IMAP subscribe dialog (bmo#1710319)
  * changed: Ignore unsupported subkeys/signatures when importing
    compliant OpenPGP keys (bmo#1884337)
  * changed: Some generic appearance settings were moved from
    General to Appearance section (bmo#1944986)
  * changed: Add-ons: browser.messages.listAttachments() now
    returns attachment headers (bmo#1937649)
  * changed: Set `calendar.alarms.showmissed` preference to false
    by default (bmo#1934069)
  * changed: Exporting a calendar to .ics did not include the
    calendar name (bmo#1901384)
  * fixed: Chrome URLs were opened in an external browser
    (bmo#1909585)
  * fixed: Race condition in folder compaction could cause
    unexpected behavior (bmo#1931863)
  * fixed: Crash could occur when shutting down during MAPI send
    (bmo#1944274)
  * fixed: Message preview truncation in notifications improved
    (bmo#1953692)
  * fixed: Thunderbird could crash when setting message compose
    headers (bmo#1803006)
  * fixed: Links in the OAuth authentication window did not open
    when clicked (bmo#1956988)
  * fixed: Mail window could stop functioning during and after
    folder compaction (bmo#1952311)
  * fixed: Error message for compacting a corrupted local folder
    was not useful (bmo#1941770)
  * fixed: Repair folder did not fix mbox files produced on MacOS
    before Thunderbird 1.0 (bmo#1942540)
  * fixed: Wrong day of week displayed for some emails
    (bmo#1796042)
  * fixed: Edit menu entries missing when group header selected
    in "Grouped by sort" view (bmo#1924977)
  * fixed: IMAP folder "Undelete" performed "Delete" when mixed
    messages were selected (bmo#393523)
  * fixed: View Message Source no longer worked for multiple
    selected messages (bmo#1962791)
  * fixed: Creating a new mail account from the menu bar in a
    message window failed (bmo#1964067)
  * fixed: Feed subscriptions were broken (bmo#1969932)
  * fixed: Feed body was not rendered when "Message Body As"
    formatting option selected (bmo#1906705,bmo#1906830)
  * fixed: Thunderbird could show incorrect 'From' and 'To'
    fields for mailing list emails (bmo#1900211)
  * fixed: `mail.compose.other.header` wrongly added fields to
    message preview pane headers (bmo#1802793)
  * fixed: Deleting or detaching attachments in a saved .eml file
    appeared to work but failed (bmo#1940528)
  * fixed: In RSS feeds, the space bar did not scroll the message
    like it did in emails (bmo#1830755)
  * fixed: Unchecking "Show all headers" in Message Header
    Settings closed dialog (bmo#1881788)
  * fixed: Some webpage links could be forced to open in
    Thunderbird (bmo#700979)
  * fixed: Right-click of message in cross-folder virtual folder
    wrongly selected it (bmo#1903910)
  * fixed: Messages deleted from a cross-folder search view could
    not be undeleted (bmo#1902597)
  * fixed: Cards view "replies" button remained styled without
    new messages in thread (bmo#1920747)
  * fixed: Subscribe window "Show items that contain" should not
    have been shown for IMAP (bmo#1630286)
  * fixed: POP3 inbox could show new mail with no subject, no
    sender, and date 1970-01-01 (bmo#1911477)
  * fixed: Folders at level 3+ were not auto-discovered when IMAP
    subscriptions were ignored (bmo#1902236)
  * fixed: New subfolder did not inherit parent view, sort order,
    sort type, or columns (bmo#1933529)
  * fixed: With "Fetch headers only" enabled, messages could not
    be sorted by size (bmo#1939852)
  * fixed: Selecting starred messages did not update immediately
    (bmo#1942348)
  * fixed: Marking a unified folder as favorite did not show it
    in favorite folders (bmo#537342)
  * fixed: Threaded search view was not updated correctly when
    sorted by date received (bmo#1257826)
  * fixed: Menu items to manage folders were not disabled in
    offline mode (bmo#1881087)
  * fixed: Ctrl or Shift selecting multiple messages reset when
    dragging across a message (bmo#1941171)
  * fixed: Folder was hidden from Favorite when subfolder was
    removed (bmo#1857315)
  * fixed: Folder tree message counts displayed incorrectly under
    certain conditions (bmo#1957878)
  * fixed: The UI could falsely report a message as encrypted
    when a null cipher was used (bmo#1943620)
  * fixed: Message security panel strings were used in the wrong
    places (bmo#1941457)
  * fixed: Importing an OpenPGP public key with whitespace failed
    (bmo#1941700)
  * fixed: Unable to open attached signed OpenPGP .eml message
    (bmo#1943021)
  * fixed: OpenPGP key was not updated when accepted key was
    reimported with new identities (bmo#1948831)
  * fixed: Dual signed (PGP and S/MIME) emails were not displayed
    (bmo#1878664)
  * fixed: "Secret Key ID" field did not sanitize input, causing
    draft encryption to fail (bmo#1670174)
  * fixed: Could not send signed/encrypted messages in some
    setups due to regression (bmo#1961106)
  * fixed: Quick Filter did not display loading symbol when
    search was in progress (bmo#1874419)
  * fixed: Search messages dialog list could not be sorted by
    clicking the header icon (bmo#1942751)
  * fixed: Repaired folders were not reindexed for search after
    repair (bmo#1348662)
  * fixed: Messages with multiple authors or no author were not
    indexed for global search (bmo#1831475)
  * fixed: Messages from authors without email address were not
    indexed for global search (bmo#1223951)
  * fixed: Shutdown could hang due to unterminated search
    execution (bmo#1934491)
  * fixed: Changing a saved draft's send identity did not prompt
    to save the modified message (bmo#1850192)
  * fixed: Thunderbird did not warn when replying to a 'noreply'
    address containing a '+' (bmo#1904005)
  * fixed: Invite attachments without a name were forwarded as
    'Attached Message Part' (bmo#1822978)
  * fixed: Creating a link from selected text did not work with
    advanced properties selected (bmo#1969767)
  * fixed: Spellcheck no longer highlighted misspelled words in
    the compose window (bmo#1971121,bmo#1974125)
  * fixed: Changing the UI font size did not apply to some
    dialogs (bmo#1916066)
  * fixed: Deleted Gmail messages stayed visible until
    compact/expunge, despite settings (bmo#399475)
  * fixed: Notification duration preference enabled when system
    notifications were enabled (bmo#1953322)
  * fixed: Chat settings tab remained visible when
    `mail.chat.enabled` was false (bmo#1671747)
  * fixed: macOS system notifications worked but email alerts
    could not be disabled separately (bmo#1964362)
  * fixed: Setting different archiving options for multiple
    identities did not work (bmo#1968381)
  * fixed: OAuth2 not shown in "Authentication method" menulist
    for existing Exchange account (bmo#1915208)
  * fixed: 'Please fill out this field' in account setup always
    appeared in English (bmo#1931693)
  * fixed: No gap existed between Back and Forward buttons in the
    Feed Account Wizard dialog (bmo#1947643)
  * fixed: Moving back in the calendar import dialog could break
    the Continue button (bmo#1967965)
  * fixed: Add-ons: Links in content pages with a target
    attribute loaded a blank page (bmo#1905616)
  * fixed: Add-ons: Context menu entries were incorrectly
    aligned. (bmo#1933970)
  * fixed: Add-ons: Optional permission prompts for WebExtensions
    displayed wrong permissions (bmo#1879689)
  * fixed: Double clicking a new contact icon added the contact
    to the address book twice (bmo#1938281)
  * fixed: Unable to auto-discover Address Book on Radicale
    server (bmo#1925006)
  * fixed: CardDAV synchronization to Zimbra server failed
    (bmo#1903549)
  * fixed: Mark-Of-The-Web was not applied to attachments saved
    via drag and drop (bmo#1805986)
  * fixed: System search toggle did not properly reflect and
    control integration state (bmo#553048)
  * fixed: Some messages could not be scrolled due to hidden
    overflows in inline styles (bmo#1951248)
  * fixed: Keyboard navigation was not possible when first header
    button was disabled (bmo#1953483)
  * fixed: Thunderbird could crash when renaming a local folder
    while copying from IMAP (bmo#1581079)
  * fixed: Some functionality was missing for newsgroup messages
    opened from a file or URI (bmo#11076)
  * fixed: Message and folder lists could display incorrect line
    spacing after restart (bmo#1947554)
  * fixed: Automatic compact did not attempt to compact all
    folders when error encountered (bmo#1903174)
  * fixed: APOP authenication for POP3 did not prompt for
    corrected password (bmo#1928803)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could skip some messages (bmo#1937069)
  * fixed: Thunderbird logged network errors in console when used
    in offline mode (bmo#1802300)
  * fixed: Slow performance when moving bulk messages from IMAP
    to local (bmo#1945062)
  * fixed: Crossposting news article was not possible if
    newsgroups on different servers (bmo#230899)
  * fixed: Cancelling a post to a news server could fail and
    remove the article (bmo#250216)
  * fixed: Thunderbird could crash in NNTP subscription dialog
    (bmo#1961659)
  * fixed: Newsgroup searches with slashes were not supported
    with XPAT-enabled servers (bmo#530193)
  * fixed: Offline newsgroup use lacked functionality needed for
    effective offline access (bmo#288120)
  * fixed: Thunderbird could show a misleading error message on
    IMAP login failure (bmo#803994)
  * fixed: Modal alerts shown for expired articles when
    downloading news for offline use (bmo#805095)
  * fixed: Status bar message did not include newsgroup name
    along with the account name (bmo#946643)
  * fixed: Reconnecting to an NNTP server was potentially not
    possible (bmo#1929948)
  * fixed: Nickserv messages appeared during successful
    authentication (bmo#1951485)
  * fixed: Thunderbird Flatpak install did not use a branded
    symbolic icon (bmo#1914381)
  * fixed: Unable to view full certificate chain from the "View
    Signature" button (bmo#1716998)
  * fixed: Organizer email address for CalDAV calendar events
    could be incorrect (bmo#1587736)
  * fixed: Changing `calendar.week.start` preference did not
    update calendar views (bmo#1918010)
  * fixed: Clicking a `mid:` link in Calendar opened two copies
    of the message (bmo#1955840)
  * fixed: Clicking a 'mid:' link in event created from message
    did not work (bmo#1970916)
  * fixed: Thunderbird calendar failed to show attendee as busy
    when added to an event (bmo#1931475)
  * fixed: Some calendar requests were blocked due to opaque
    response blocking (bmo#1920710)
  * fixed: Visual and UX improvements (bmo#1935652,bmo#1941139,bm
    o#1949828,bmo#1952481,bmo#1955860,bmo#1968444)
  * fixed: Security fixes
  MFSA 2025-54 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6427 (bmo#1966927)
    connect-src Content Security Policy restriction could be
    bypassed
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag
  * CVE-2025-6432 (bmo#1943804)
    DNS Requests leaked outside of a configured SOCKS proxy
  * CVE-2025-6433 (bmo#1954033)
    WebAuthn would allow a user to sign a challenge on a webpage
    with an invalid TLS certificate
  * CVE-2025-6434 (bmo#1955182)
    HTTPS-Only exception screen lacked anti-clickjacking delay
  * CVE-2025-6435 (bmo#1950056, bmo#1961777)
    Save as in Devtools could download files without sanitizing
    the extension
  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
    bmo#1966505, bmo#1970764)
    Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- Added mozilla-bmo1746799.patch
- Removed mozilla-kde.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1753704000">- Mozilla Thunderbird 140.1
  * fixed: New folders were not added alphabetically if folders
    manually reordered beforehand (bmo#1973085)
  * fixed: Message archive folder creation could silently stop
    during async folder creation (bmo#1971248)
  * fixed: Security fixes
  MFSA 2025-63 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL”
    command
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422,
    bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998,
    bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1754049600">- Add patch mozilla-kde-force-xdg-portal.patch to switch to using
  xdg-desktop-portal file-picker on KDE on SLE-15 (bsc#1226112)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1755691200">- Mozilla Thunderbird 140.2
  * fixed: Users were unable to use Fastmail calendars due to
    missing OAuth settings (bmo#1978192)
  * fixed: Account setup error handling was broken for Account
    hub (bmo#1971303)
  * fixed: Menu bar was hidden after updating from 128esr to
    140esr (bmo#1979002)
  * fixed: Security fixes
  MFSA 2025-72 (bsc#1248162)
  * CVE-2025-9179 (bmo#1979527)
    Sandbox escape due to invalid pointer in the Audio/Video: GMP
    component
  * CVE-2025-9180 (bmo#1979782)
    Same-origin policy bypass in the Graphics: Canvas2D component
  * CVE-2025-9181 (bmo#1977130)
    Uninitialized memory in the JavaScript Engine component
  * CVE-2025-9182 (bmo#1975837)
    Denial-of-service due to out-of-memory in the Graphics:
    WebRender component
  * CVE-2025-9184 (bmo#1929482, bmo#1976376, bmo#1979163,
    bmo#1979955)
    Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird
    ESR 140.2, Firefox 142 and Thunderbird 142
  * CVE-2025-9185 (bmo#1970154, bmo#1976782, bmo#1977166)
    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142</changelog>
</package>
<package pkgid="9d2959909a8336496fe4c4e85c8017decdf6fa662a3485e52a461c78f50549b3" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2d5a6e17674afbed0784b8cd91a1b38de65c7e46e56de490433fdfe742a3baaa" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2434d2111245b044045f77bb20ba44f6a6d5c94558adba178ee8c276852bc330" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bf5f91906c807afa7dba30b0c42ca590e5bc112a04054238e3c188b47ceef55a" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58a244f355b892cfaae060bbcb95748e80469ec0c82f7aabc142fb0a47535cf6" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="26984a2d07f87ca428ae55858d185a57206df691b61b96e4ed21c52afb3e5a72" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="fdfa6281d2348525e1df1aad62d662e71d189ad1e903fff7e042190cfbf359e2" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cdddeccca0b11daa1b3d40f89eaf6d6f71eecd104123d26cfef00983c4bc13ec" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bdd224ad120f571f718fcfabbc2c5d2cf4c5caafa7a4f9f11f6e34b7a1ad717e" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e4611bc8ea226e7fa77a6375c91677a5ebe26284085e4b0590d407e31a2ec8c2" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="baed7e5c564c8d815113e5db32f9c095aa47e326fc5f4142765bd47100a2248a" name="NetworkManager-applet" arch="aarch64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="0ab17d76000e8d2d7836c892ab20bdc2cb5c4167720e1a1ee9f6808bb1132b8a" name="NetworkManager-applet" arch="ppc64le">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="b773219fc412e11d045cc070a9306ebb36c0087c65a2c76ffb2ca3896e4dbf5a" name="NetworkManager-applet" arch="s390x">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="2f20e0ca16952b7ee09ca0d0fa5301eef1cea869668fcab42e7a8291cdc7cfca" name="NetworkManager-applet" arch="src">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="07d62b8f5e35195b044e36add5a9f387348bc8f7be4eb73593481b6a0e145c4d" name="NetworkManager-applet" arch="x86_64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="5242e3333bf09e3905a8e8f489c16ec44c5df5d9607887c1642f6a93b95cad55" name="NetworkManager-applet-openvpn" arch="aarch64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="84a2559650afa7c704385b1ee60b96f7151c0e2dd1693fdc22f228e35d4fdb13" name="NetworkManager-applet-openvpn" arch="ppc64le">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="af76b090f43e40a09ace487a68652df454247cfee526a278616502e87808520d" name="NetworkManager-applet-openvpn" arch="s390x">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="209a6a3aee25d55bf8cc710b6d5d99126652a70234093dec71f40b1019d51e91" name="NetworkManager-applet-openvpn" arch="x86_64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="b24e48ba95bc28c01ef6bc277a897e6411d724de0d647c76c6912ff9781a5052" name="NetworkManager-bluetooth" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1f91aa4cb262e178770def0a546ff9bdb4dbea557c1cc8a287b02cc003dbaf83" name="NetworkManager-bluetooth" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1678c151c7ff858bd58f1bf8861d3ba2d0941272e3ad356d14db11accac679d2" name="NetworkManager-bluetooth" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f676c6315a934f5da997599a4ebe8a7065c83f5c05885ffccc39656ca3a83a6d" name="NetworkManager-bluetooth" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="83c034809cb11fe40fb68420e1990d59a3b6057f862074bcc0f48f9cfaaac10a" name="NetworkManager-bluetooth" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e2f1cf18faa1950d048ccbc347ad48d7ea4551b6cfd608a85d72fecafdc29e47" name="NetworkManager-bluetooth" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="7ca8b627110563f4fd9a058729e5a9911114e651a0edc8bf909c48545e2eb1a6" name="NetworkManager-bluetooth" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="4e1b88c3bf02def76272e97a24f5dc8bf6e7638d1304894ea5a75631cf964444" name="NetworkManager-bluetooth" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a325f57058452704a35e7b0d57fcfad332c31d689502c83c972a83ca19ef1ad3" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="15d1a140ffe68b9d7cd670cea65ce44ac2144e896c794564009361e6587206a8" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cb6dd12beeb93e8ced46ca422890b01d85b1f87e16d7a5d56e6e5d5c9291039a" name="NetworkManager-cloud-setup" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="78c3b649afaf92f8d263a3fd8e7e7da86140bf1c4fe6ca12ad5fd21cb4545585" name="NetworkManager-cloud-setup" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e35fe7059fc7b50925656e31deeeb9a1492958d09e16d0420eac6bebe6401a1c" name="NetworkManager-cloud-setup" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e61672434148e4e2660e8d8d38281abdd1ed782fcdede0cae32603d6e50ba2e9" name="NetworkManager-cloud-setup" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="9795902944b135cc5b8360a42ed4006750c5db9ba6648f258cd3fbafcbfa3ae4" name="NetworkManager-cloud-setup" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="b15a4e9b2bd519f465c2352468866f55465770060cf296b65d6efacc73a7802f" name="NetworkManager-cloud-setup" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8119e5247c36982f17f66279bab3054b5f0a9a0fdae47519caf415da91ea837b" name="NetworkManager-cloud-setup" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="432a10103b124b89f5b03d2611bcee8d95e8983f3c3c905993ce2808045bbc9f" name="NetworkManager-cloud-setup" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="97997c3638a9b3cfa4ed2ccab6fd44479983925e2ceb10501e3c693031acab54" name="NetworkManager-connection-editor" arch="aarch64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="b1fe9312104df5bdceb93f9973b1eaa39bb15b12dd524eacbb480c5a805ba1f5" name="NetworkManager-connection-editor" arch="ppc64le">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="456f8982c7b819a224f3c3d64b9d4cf57c486201e682f4083ba61b25b78903e4" name="NetworkManager-connection-editor" arch="s390x">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="014f63110f50ccd5a3072e8b3311a1b46d14e1d6223a262b05ce1e2669ae878b" name="NetworkManager-connection-editor" arch="x86_64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="af8b60c8d0059bf799be683c447cdb69053928e9d1517152516e1a9c08113157" name="NetworkManager-connection-editor-lang" arch="noarch">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="bc1bf0439cb48956be8fab55b4d84c491b4badeb7d3d0e19c35d3559b54657ab" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cc00818ff7b976130280080242b6fea205647599e2bf8de04595ffb213445318" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2c6efe42e2406658b61e4c7de8056b481038e7be9ba0652468be363b45ae2c31" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="5cca66d1b05df05f577921362ab27b4375ab5bfb578d690d29e5ab11f704b06f" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="00a2851fd6ab1ef174dc456b8e7a5c3bb8e89603db5c83e391cc5aa04a9bf848" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6fda84f67353702671ae60242bbfe2d6c4637b0f9131320efcafec6e6eebc08" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="505b404d960dce641d6229e1ec5cf4a5a963ed31674f602235bf63a1fc194707" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="b1f23375182fbb2cf969a585cf5a67380fd3258cae701a2c8b0df0513612755d" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f5940436f1957588697ecd379699ce97fc9d4af4a6c1d957d91ed21ed6fa8ad0" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f176de6bfc42a3f48db3098ead61b759e0eb5daefa643a74b2f2a1210c9b6707" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8a3d957a31e706c127555a87df96e9282e44d05e71ef5680dc865d63051e2c4f" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="9f01d085ad4acfd506487fdd95e878e7986b52ff71ebb4570fe0437e445e3848" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="97faca2f27c4b9773ed6fc9ae4a1aaf4bd0efa643f1de2cf9fd1dd22c560f8ec" name="NetworkManager-openvpn" arch="aarch64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="5451940c22b3a7d0c27c42ca090da5f4f18888e7b584ba4594d5150c9ea9442f" name="NetworkManager-openvpn" arch="ppc64le">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="4a53d8caa90fe8f4aa9db03c94152ea932cf7f1fa77a9bac2242e48ed7a6aa65" name="NetworkManager-openvpn" arch="s390x">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="8ebb2796127912b76b1dc3d32b43d02fffe854e3dfd51ba3d91039039f1d70c9" name="NetworkManager-openvpn" arch="src">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="7fdfd29fa82e098de8654863a003b977f2364e42c4f6812871f4c23a38211979" name="NetworkManager-openvpn" arch="x86_64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="41e87367f3c689a9a167ab98a00afa0b638fed282a975c0632bb37c4063a1840" name="NetworkManager-openvpn-lang" arch="noarch">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="ff1d43362f378c4f004e2ab95467f1d75f9d5ad2bfb31b40e5d90063b7aec4a7" name="NetworkManager-ovs" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8fd7d835c2715415175b95b97f21f2d0754c4cc24a9fca2827c99f5544f8c696" name="NetworkManager-ovs" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="fbb855f3518d417848b2d6f38fad73d60eb490200b5ef85d47bc488da4c5c87a" name="NetworkManager-ovs" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6bff24ee0db2972f964a0c298ff61a648e85aaaac5990ecddd2d5191d90f934" name="NetworkManager-ovs" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ff7205cc4925dfeffd3d7e5cf76a6f033abc20903913d5706a6829c95f08ca3d" name="NetworkManager-ovs" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="21d9e8883495437a99e2c00c6a7b3e9c03c95b87dff444e0ae9b0fc6a1f7eb11" name="NetworkManager-ovs" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ef85b2e97625bf43a62b58d135dd86b294b96059d2cef16130b37cc624899954" name="NetworkManager-ovs" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="86dd447240f99dcf1533cf7e98b4e30d70ef8b460668ae88fdeb7eccc71efef3" name="NetworkManager-ovs" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f24728c555a281cc7a7421318bcf6dbb42a2916b71476b0a2b45f4a06605a172" name="NetworkManager-pppoe" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="91bcb0303ddf11142484dc2850649abee269ddfecf8c3899ec8fe4d8771f8943" name="NetworkManager-pppoe" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58315657c14e29ae92d3b7b7eec86b65fdd11e3732355df3918a38ffcf4b62a3" name="NetworkManager-pppoe" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8364de7a3caa1d44c5b13606186e275203fbad492dd31a0ed7d71e6ad6680bf5" name="NetworkManager-pppoe" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="be9247b22df7f74c1f21e2e80b28e7de9ce643f07506c964a1b01b4fb18936e7" name="NetworkManager-pppoe" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="212183477319544f1c44f817f14a7993988eb2545e8acc41fb407b7cb2a44023" name="NetworkManager-pppoe" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1b4db8ab68e7e61f58679977987936b2c2141b26dc44c40dfc52af4785033df5" name="NetworkManager-pppoe" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="9263325de4ca187f454a5ffb139b1a8c53b18d2dc86b9f766f0a1ce80efbef39" name="NetworkManager-pppoe" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e75e4271d1798bbbce4307c9ee38d5c5a226885b99c53403b30b82eb2914cb0b" name="NetworkManager-tui" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6362dfbec2ac0748f5b9822a8d70cd9a5600e82238046f875842eafb93bfab3" name="NetworkManager-tui" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="633701cf772a73d24f48c4f89bc72cfd9ba7ba64b36250f15883cefa96d9db48" name="NetworkManager-tui" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8e7a35a106a9202ee7e4b7f592ea4d809edaad86f8d55a5888533a95d17af503" name="NetworkManager-tui" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="9c227201c8f3b081a95adfa5f20f3640425caf82ddb047c03999f35c834ade11" name="NetworkManager-tui" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="eceb8ca9e86457461c8c0f5320d0285601e36c50bc918e08340d44297e9ef9b3" name="NetworkManager-tui" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="44a32a8fcff200f1a82898d2dd82975a99290d391afb31db88a8bc22e9095407" name="NetworkManager-tui" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8f9803c1691f275eaf43080240640d9093c32882141c2ae558c7208a524895d3" name="NetworkManager-tui" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="36df225b0b4ba5efd6efa1a66c5a4b80873888d25519de154d02bc13315a8088" name="NetworkManager-wwan" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="dc38789a135fd180d418a256f779ae329a2334e92ea8eaf9dc385d4d0130a92d" name="NetworkManager-wwan" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1cf37e03d27bfcc2eb0c7df0164045ba9d90d5ebe53a00d4fe289bbcdd965e04" name="NetworkManager-wwan" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ac7bf279a3264b6c47adbaa5a02599eaab5d355739f0d3912be91e027beb1593" name="NetworkManager-wwan" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="7e822d76efa0949f29dce809279715a894c57faf548b146c5e0e320140d068c9" name="NetworkManager-wwan" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a69f63a3b91a2f42e05a6bb4280e3c8964145b6553577a0308bf37f79bd1082a" name="NetworkManager-wwan" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="4af07ee988c066fe0a32fb6ebd4d24098ccf8cafa0f8de38390c41485ab0a3bb" name="NetworkManager-wwan" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="5319a56729910f1c61fa5fff2427c815decbf0683f44d14f327cc9a4506c7444" name="NetworkManager-wwan" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.4.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a616ef50501a1eab0baff115549c723cd68f43f3068e86e316baef428ad2b1ad" name="OpenIPMI" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="05a268c5077664b2dead41e3eb28b48a8fe9d880f91de6d4998395fe065ff3e4" name="OpenIPMI" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="33daf99481879d9a3b75f2664c0f5d39127b365570f2f0a283afa05fc3b4a05f" name="OpenIPMI" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="77b8ab3ec0554b4c9bbdd2520e1b771d3a4b1510fbc04cd93cb6c24fbbe9831d" name="OpenIPMI" arch="src">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="41a3568c88aeac1be0758dd4de0d49b7b696325a5858e3aa09cd3e60fa95f206" name="OpenIPMI" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2361dfff3824112c31f4aa6c3c527f28b792bc10cb8fd83414ef620716847e26" name="OpenIPMI-devel" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2d6d02b1c8bd49ab7d11d7e5103ec68757e4eec8966cebf378778b52a6a4a4ba" name="OpenIPMI-devel" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="68542b5b49bd06009bac5f48c7c0e3b27736cc2d10566d1f595461ef89d400ef" name="OpenIPMI-devel" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="229b046963f1f71eb162b555a72a692f3f4599957b907c3305eab4df48c1bf66" name="OpenIPMI-devel" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="d61728a1500d6a35e49c4fc4dae7096438f0eb110fef79a07b7dcf5aed13abb8" name="OpenIPMI-python3" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="ddf6c405490ab5f70b61d2306e6b1ad05cf27068b2a9b2ff13c86d5e2d3a3c3a" name="OpenIPMI-python3" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="91affa7378eac222dc8df7089065c88fb8f7a2aecf5e0bff2733bc25a92404d9" name="OpenIPMI-python3" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="a11181aeb979188338f61b4a3193906e8b69aa861928d2ec0e64a0e4a21f8795" name="OpenIPMI-python3" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="edf10d74afe9a5808353fcd4a700aca72b8fc9574991766c0942c47c7ec872d7" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="242a35e782f1c2cf52764cc47c40b35ff9027386edcb75a993cacdd18ea88e05" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="61e8cb31f92e27f52e2a8514eb18ef46f997632c80a862a6d3800d57758f22ff" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="91558d9c65dabb869a2290172333fd457dd4ba782830cf3f79442c763bcc3ed2" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7cda6daa85e46ec139dd7abe310c6cd157c3d29c8adee4600d6a0bd827937935" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="1f78ebaf8a198e9411b1a97dd2feb26b676fd122b639cb8126478d4c8993c290" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5f04ee7ce71cd6fe18985f865b8086a1f5798a1c9d8d0f70eb0d45d2a5103478" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b00e5fd218d9b1a50ef946b9afa129824a92f2e11e3ded338925674b4db2f845" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="81ae56efda9a56a1828b2459d67dfd5149d98a2f863cb355eeb5f490b1d7e9c7" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="87b57be163e5f870c5289d08368ac974065e36cdbb38ac31432b60423145a77b" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="16cb26bc57089d9cb73053dde8b23f61ac4bc91a04485e6c9dbe1f7490938555" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="e87fc2aeb1fe45ba1b6605100b53d14447022a2fc199ada51e6b2b5c88eb30e6" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bd84b033efd0f024bcab110d7c16a54efd2d704c315b1cb6cda1d6db5354ec3b" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c8e7608ef440349d74d747f576560f62d0bcb38987cc54a9e7b31647394d488b" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="9293c2adb3982354e698af7b0a2bb4a47030646eba28f5704c0abc4c2fde4bb2" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="f8d88ef5fb7c3013da12afe46633b72f0f023a13978fec668fb303c95947e9c6" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3f7c48731c1e413d112f0f414915fa8ce493414a9b534804c1e805498290d73b" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="e6eb0b2a2a65c7226a5995857f43f45a4d555f4f65f11f408392b620228eb34b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="34ebac62adc360720ff2a82031a8d24ce7bde64091a30ca8f52c0ce578be5f54" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="15e562ac20e61bab022fa6780f28dd560ddcbbf903af74641df835d57cbea684" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="71bba0f18aece203106bbed861f5b6e307207aceb7f42554980f319872f76581" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="dcd2eec48560422ca7f49b0700368e88e9ab5e557c98ed0d051778017633d647" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d64ea88b0e84cd5a3303b7a96b0ef86f90e60995d958d9ec84f70928050cb2d5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b4d8a4f12728c4000b3a8aceb58eac70cd31dd904d50256c12d844b7ec959fdf" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="af36ef107ed66ccec28519a5c7d3a8273fb6f53688228a5d53e30e24ac23b516" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c35caf9bcb3f6f490bfde00b0c3968922c948d5a2ca637aa7ab027fdc5de98df" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="83013de86948bac18a7bc007e656261d8bd984747db22e59774736777383b1f5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="3d96880e305524eab23bf121b65744b2eed11202febddc85482248b831e1ae71" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7874859d99e0824523e8d58e55574183b924c058591ca584490c2baeb01cc893" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="60456ba93f333cd868a72e31ca65a9ffbc389495bcdf25c7186ad47e08cf2ffd" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="0eae9ae8b0453de6f76d626325938f43da051b58ff236c6570f00f7b8c3fe726" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="24515b0b432820dfd45823de76e46adc3ab8d9897040658ef1a593aece695dcb" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ae5c1a696ba543f154398177b802e1c94f2e1ee36a17378a380ecd8cbde0b2e7" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ab8cebb75d5962420dc39eb7f6fa0dee1892b65c192cdcbc15499404e7222c65" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="a99c93738ae033cc52db30662fc190e3b516907a848ee0fb2af25195fa29e00e" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5501254f3f51186e86f59ae8c2e674693adf064062e36a85ae5da9d802dbcac0" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="7a1720c1edf06dd2b2e386bebaa6036882586784f6e4ed14e1f98cede5a210aa" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="108d15ae8932f29e8f525b1ce8ba3db4361a9cc84e1ea30d2520e0d82e5db564" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="dbe1dc7e6c0eb6f77ad476c1c43e60b7e5b30f0167a868cc8379a1d27141e68d" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="ec3e8fc5819afec02382e909ab97af5f842ed23d4acff634c2dbe3d6e82b4b87" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="b049d40bba76bf87f04e17a3a47ec44e52d191c5266812bfc5802ddeb75154cb" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="16c3eb6b431960e0a8d6359c2c716bc6f3e8c6010653d9ccc1d1cc9f77f0061f" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="259c40ef5ee577fb650093051bdbfdec63f635c63826f02fee8c25e091deff1b" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="ebe7787ee3322e65464358fac86977e3987a133c48b2abea0e352e42d5aae80e" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="f3b93089633cd6da6e886774388526278f511c52f83e507ca3216486536b33ca" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="d15beecd3c85e770feaacd93ce2174b210c61b08fca99f790ad457d7cea407ae" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="99bf72a04ac2ebda4fa950a20fe8ebae46367a0d31752c4a5b338b0fc95d1bee" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b5ecb287bd69b4b3360ad2f80aae003259e60af0512ff01fd7499dd6dd0a03e4" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="93aa5ac1a52e19f24b3ba71b58dd8943c504ca19d5ef5aa447745ee753be5c53" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9654f62636b4f189a23539fa922b4f94e96613d002a9f3b5eda6b41f02555cd0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6afa8b6351ea9eaff326e083930d36d37657d4b7482ebfbb45199cc1f5b0631" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2630835d315a24e76c261b2e933bd81b39ed676f891ab12da31c4e4bdfc6494c" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="30c09b77e649df871986dbb8cda014b91a0aa46cb93121d90decf8c053a6ec70" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ee2ac00c6ac376d18558d61ee8baf32de7953904ab01325bcd5e41492da848d0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8f188c7006017d5d08944969185c1e9d2731abe371e4b5d1506d51f658149d89" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b11f1812406af7c636aceab50ad399fa2003db5d395f344bf352d0ceffe78439" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="45defac5bcea273c6299217497dce7ffe33a18ef35d80c28f283712a3841289e" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bfe28b94c014133a58bda722ec53e720edd10184085dd7efd64c1f5c854ab588" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cbcefa5646e8db123176a6a49d1d888148e5ce13f101d3b3622df4551bd0d580" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b92cbd6da72ac7c317a73c00e440e0ce69cf943a2988c99f8f1f8eded04a719d" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="2f6af57ea5d35fc77a8a464678c07f39792a9787851015f0991b660f1ec94470" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5da541313a499bcacb0fff0b1888376202ba62a5c9618139c02afa4cd2c0a7df" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="010f248eb2b5112b310ad89c198831786c67bec91338b9531e05797e6c931b0d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2a20315555e9d17e8f11a27fa89c9fbb34513a103ae1f89a475abbaac0e63714" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="05001c4042ac43d171c329eff6dc1ac0c9b6e89908b55c6c89f1962ae1ce848e" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5282f9a5470b82897e7af581ea2597b513a16c6d1b1fe362c32f66cfb3cadec0" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d435ccab2f1751d83cef002c33d54ae7d87e1c97a919ffac27850ae132dd380d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5b3844387e2b684c5c8357e85e2b01b7de88a408e996725b92c458ede8f886e0" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b48d7e5de4f85e9db9af309280c9c57caa61d0b0c8c6ee299b9149e6c937e267" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="adab6e390a1ba32c109d01c0cb65b430b907bf7756087ee045a178663f4e0f88" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c0c47fd8df16b269046db33349b43bf4bbe10b3385ed7dcaecba6727d28053d8" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="15aba99ed1588032d7afd4c0e04d6019f042840c1ee3682c61aede8f0b2b24cc" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="fe8e3d969931a3d3d0d9f503725b744aaaa2b8511b619ef156e56e67125c2330" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="36bda4ed9a819db6fda4ee05843dd9a333f4730f356ba379086528c2cc9d305d" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="89e2a3fbb620953cc14ca8db100589940d17c8e4893adb8b1d9a5bc7791c91cb" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8da17828bd0a5c20a2e444685305afe476d727fe8201bb115097144854d36164" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3d2a67b2d0c5b464a33967496287982b4720dd3ceba6c24dde6dbedfd0336867" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="f6c7f3fab73e092d33d910e70a2ccd32bc3b80f56838639573d40cf27fc7da24" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="28ae7a1fa72acabec603188a5ebe18540dd6ffbad63d7c63dc3284607456bc14" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6abb5b586a234de2fcaa26e04421d68df840923955ca5fd09ebfa8d21158fd1" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="229ab73b9dd67a404a425d67f39b6a9afdf197f66ce29f2dd8bb5e56d79c2510" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="a7bfae8478084caa660a51300e8f29f34c1b8517690b6dffba95dbe30d80b8fd" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c9651c420b743966c9c8ccb7a03a53553b7392ec1d40dc287722071e3db58cdd" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="764a0894a7b577ee9f3659248f0081061d3598804b093723da22c9c31606e788" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b730553ee8bc61cb24b5a94f34233695f5ef0fc1aedd32fdf7caece6e4d2b0cf" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2bf77889cf9b27c0bb909373ab57e4982115da1297ada1eb42d0eb63640f9b2c" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9e2d280e9d93ad67dff5364a8d819edc57a6fa66ef86073432e1222b92914f33" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cfde0143f2b5d71dc8a2aa000c2b43107e788a3d475406319517f31839a174c2" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="43eb6fb753bd1990cc1f97c4964928053e1fc1a527de5a44078e979f3f2e6071" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="6a7a910b5bda6f9d5253fc4508b2550a7876f2e8825f2b287a12a95917e790de" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="305642dd8be6d602f7224f94e3283fd6b49a996351df76d89dc0ae99ebf2829d" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="ad0a395c14e26b54b0ccd9e372f7c00c24b9c7606a09ce483c27ab2d402eb83c" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="c31b31fa0453ed8c11df97e3b2e756a396ea1878e24029248893af5f37fd6a22" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="ca3d9d6101f8bb794074384bb1cc5c3019dd2e51811850027c74e3468024026d" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="bdc264a0ab5e3b1734488b90c3b2d520f7ae34d2c216033bffead164d647d6ee" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="d0f1804ce5c643f5638be76e4be4d3a44e9abce91b5b443d94637d1b8f0fd990" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="1f753346aba5ba687bab3e998054eb616eff9e92030bf3d802bd0014fb1f0937" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="818065b32870370f7329b41307972efb498fc0f595f2b52cdcfb6268074c0d56" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.10" rel="150500.3.15.2"/>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
  <changelog author="abriel@suse.com" date="1741348800">- Version bump to 1.2.10
  * enhance virtual hostname detection.
    If the saphostagent fails to answer the ListInstances query
    additional use the &lt;sid&gt;adm user environment to get the virtual
    hostname.
    (bsc#1237473)
  * support hostnames containing dashes
    (bsc#1233972)
  * remove use of deprecated command crm_master, use crm_attribute
    with option '--promotion' instead
    With that change use '-INFINITY' instead of the short '-inf'
    for the score
  * try to recover lost transient cluster attributes
  * decline promote/takeover, if remote node is still member of the
    cluster but lost his score value.
    Membership check against pacemaker and not against corosync.
  * SAPHanaSR-hookHelper - on action fence, kill hana first to
    avoid call of the srConnectionStatusChanged event which would
    result on SFAIL in some cases
  * remove legacy tools added accidentally
    These tools were designed to work with our classic resource
    agents implementation and will fail on the new implementation
    using different attributes and logic.
  * new man page:
    SAPHanaSR-showAttr_properties.5
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    SAPHanaSR-alert-fencing.8
    SAPHanaSR-hookHelper.8
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susTkOver.py.7
    susChkSrv.py.7
    SAPHanaSR-showAttr.8</changelog>
</package>
<package pkgid="ec2793270e0b3162d1d696ae3f56910c557c69b8465651ee37fc8efffb7433ee" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.10" rel="150500.3.15.2"/>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
  <changelog author="abriel@suse.com" date="1741348800">- Version bump to 1.2.10
  * enhance virtual hostname detection.
    If the saphostagent fails to answer the ListInstances query
    additional use the &lt;sid&gt;adm user environment to get the virtual
    hostname.
    (bsc#1237473)
  * support hostnames containing dashes
    (bsc#1233972)
  * remove use of deprecated command crm_master, use crm_attribute
    with option '--promotion' instead
    With that change use '-INFINITY' instead of the short '-inf'
    for the score
  * try to recover lost transient cluster attributes
  * decline promote/takeover, if remote node is still member of the
    cluster but lost his score value.
    Membership check against pacemaker and not against corosync.
  * SAPHanaSR-hookHelper - on action fence, kill hana first to
    avoid call of the srConnectionStatusChanged event which would
    result on SFAIL in some cases
  * remove legacy tools added accidentally
    These tools were designed to work with our classic resource
    agents implementation and will fail on the new implementation
    using different attributes and logic.
  * new man page:
    SAPHanaSR-showAttr_properties.5
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    SAPHanaSR-alert-fencing.8
    SAPHanaSR-hookHelper.8
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susTkOver.py.7
    susChkSrv.py.7
    SAPHanaSR-showAttr.8</changelog>
</package>
<package pkgid="43d7e0b632411e6e0bfe04ed9cb80055d4c03d61981f6b66ad27f7fd879c3a6e" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="018c692ad22e0691d93dad0b46e98b28ff901c4059e1f6f8395dc9039dd490e2" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="802afcce56204075ebe63de3faee067c32a55a1742d6e61330b317bd518099f6" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="8df139a961d0cb77202418f3713d0cdc22507a405338a176a62c97cdf5835876" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="56796144e77787eaec40627a45b56338fc3f2ede6f97eb98d38683f8cf49d043" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="79bafe4cce351957a6c6b1f6c9e9752e923092dfe5645d6f55084f38f89ca964" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="4212f14fa45ee3e11e352de344fc01d09ef6937824cacf6ced8d354fdc28a2f3" name="ServiceReport" arch="noarch">
  <version epoch="0" ver="2.2.4+git7.8ca0fe4" rel="150600.3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699358400">- Fix build with RPM 4.19: unnumbered patches are no longer
  supported.</changelog>
  <changelog author="msuchanek@suse.com" date="1709035200">- Update to version 2.2.4 (bsc#1220410 ltc#204408)
  * ServiceReport v2.2.4 release
  * [kdump] update /etc/sysconfig/kdump config processing
  * [kdump] customize initrd dump component check for SLES
  * [fadump] update initrd validation check
  * [kdump] restrict lsinitrd command to fetch only modules</changelog>
  <changelog author="msuchanek@suse.de" date="1729684800">- Update to version 2.2.4+git2.f1e4503:
  * [Service] Make the servicereport service dependent on the kdump service
  * [utils] Use --update-bls-cmdline Option for GRUB Update
- Refresh harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1744977600">- Update to version 2.2.4+git5.e48c02c:
  * Added hardening to systemd service
- Drop upstreamed patch harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1750420800">- Update to version 2.2.4+git7.8ca0fe4:
  * [utils] update logic to parse /etc/os-release (bsc#1244547 ltc#213710)
  * Added hardening to systemd service</changelog>
</package>
<package pkgid="72a31ba854da8f456d71987fc8c0d3867171060c4ad659a8c3106ab5bb3c2ef9" name="ServiceReport" arch="src">
  <version epoch="0" ver="2.2.4+git7.8ca0fe4" rel="150600.3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699358400">- Fix build with RPM 4.19: unnumbered patches are no longer
  supported.</changelog>
  <changelog author="msuchanek@suse.com" date="1709035200">- Update to version 2.2.4 (bsc#1220410 ltc#204408)
  * ServiceReport v2.2.4 release
  * [kdump] update /etc/sysconfig/kdump config processing
  * [kdump] customize initrd dump component check for SLES
  * [fadump] update initrd validation check
  * [kdump] restrict lsinitrd command to fetch only modules</changelog>
  <changelog author="msuchanek@suse.de" date="1729684800">- Update to version 2.2.4+git2.f1e4503:
  * [Service] Make the servicereport service dependent on the kdump service
  * [utils] Use --update-bls-cmdline Option for GRUB Update
- Refresh harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1744977600">- Update to version 2.2.4+git5.e48c02c:
  * Added hardening to systemd service
- Drop upstreamed patch harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1750420800">- Update to version 2.2.4+git7.8ca0fe4:
  * [utils] update logic to parse /etc/os-release (bsc#1244547 ltc#213710)
  * Added hardening to systemd service</changelog>
</package>
<package pkgid="ac74198ca85ea27504297d47ef0cc9076f2ed5b0c70ad26eb330a8e55612fcb0" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="cd65cabda6c6d064e57735912506836619ed033d1c8b0d615281dafda4d0513a" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="51bfdd91c4dbe130fcd2abf23a5d91ca58871ecfd7f583b6eea4d2f4eb8ddfd4" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="f402fb459061e9c6f49e6a9d8e9fce54453b3d35f68fd5750413eb420562ae44" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="2a46b59e7898c652fd86b44286d09e47dcfb37cc52bbdb2424e0aa544a3d8791" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="f6641ecd3f79b17823293b1929934167977c36d36f083f35cb7adaa34ad4a994" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="21f8a6c54991e6c2395106dcdff13457cb1188b3ecf9d8279646f3e7a3f0b695" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="4af9c06f3caa725a3687c6046e5ce9f2e8ffeab3d05b68423d2638775dcad276" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="924bb3fef4ef8497dc9fc61bfe2c967027adbb354195630ea8aa09b57b4d8fe3" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="44cf0c5913c02d7045dcc54fc4773b8af8533822128bf518333ad0c3abb094b6" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="3bcb1b7a21225183e5f96905ba2f361b0014f29e5a72fcec9d1cf8a4cf8c2c55" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="22410e2cb9899cb095e04792447136c2987ef9d8961433316be916bb386b81fb" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="48f4f22e7d03997b71aee25a1c014c48508cac335d92278b5ded9c0f92972ee9" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.5" rel="150600.12.43.1"/>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201,
  CVE-2025-24189.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1754395200">- Update to version 2.48.5 (boo#1247562 boo#1247563 boo#1247564
  boo#1247595 boo#1247596 boo#1247597 boo#1247598 boo#1247599
  boo#1247600):
  + Fix several crashes.
  + Security fixes: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
    CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
    CVE-2025-43240, CVE-2025-43265, CVE-2025-6558.
  + Changes in version 2.48.4:
  + Improve emoji font selection with USE_SKIA=ON.
  + Improve playback of multimedia streams from blob URLs.
  + Fix the build with USE_SKIA_OPENTYPE_SVG=ON and
    USE_SYSPROF_CAPTURE=ON.
  + Fix the build on LoongArch with USE_SKIA=ON.
  + Fix crash when using a WebKitWebView widget in an offscreen
    window.
  + Fix several crashes and rendering issues.
  + Changes in version 2.48.3:
  + Fix a crash introduced by the new threaded rendering
    implementation using Skia API.
  + Improve rendering performance by recording layers once and
    replaying every dirty region in different worker threads.
  + Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
  + Fix a reference cycle in webkitmediastreamsrc preventing its
    disposal.
- Increase mem_per_process again to avoid running out of memory.</changelog>
</package>
<package pkgid="66357789d77c102e20d261f724e311304ee86c8bffd6820b3140d2114debb37f" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="2218e37ef2e90042f169d97d09d1079baed15e059599919c124a57e5c41ba3df" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="3ae29990e655778908f431d27d8d0cf897f9ef8d7d400a8f7ad85cb021b137dd" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="b6f285b9f078955078877649a26c60aec4bc32e85bd8859046c95b092dc69f89" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="f1b7395bae575912beefb4c287368343ec686678b850895c3943c74dd2012a07" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="74f69a31251856a6265bfaabafc6cb867f62bb34abedcf1f3131028d826adeb0" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="110945b61f900e4f221fbbe914f7eeec7e7379ecc85667e1960006156c4c39e6" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="2b0203b1b8666f74015ee22c1f9e8dc3e15c294f813b12ed89cf94a0fd4dee84" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="71aff0208f8e1de04635e03bddcaba2a1e9360d4ccde6dbe96cbd82c555ca1b6" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="999229b2a65607abda54e9303c1b130af43619a50fcdcf7c80b310b1d8ef2928" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="24faf76f63666b5f78285245064da99c6a653abbf5a75573a58197d6512c1620" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="4fad5119ab93cb7e3d5e604f26eaab3437e631085bd814110601d5ae60ac6398" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="4849ce17c357368ec2de8fca2faefebc671c7f30f4a3f652c2b735cc2fbc07bf" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.5" rel="150600.12.43.1"/>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201,
  CVE-2025-24189.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1754395200">- Update to version 2.48.5 (boo#1247562 boo#1247563 boo#1247564
  boo#1247595 boo#1247596 boo#1247597 boo#1247598 boo#1247599
  boo#1247600):
  + Fix several crashes.
  + Security fixes: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
    CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
    CVE-2025-43240, CVE-2025-43265, CVE-2025-6558.
  + Changes in version 2.48.4:
  + Improve emoji font selection with USE_SKIA=ON.
  + Improve playback of multimedia streams from blob URLs.
  + Fix the build with USE_SKIA_OPENTYPE_SVG=ON and
    USE_SYSPROF_CAPTURE=ON.
  + Fix the build on LoongArch with USE_SKIA=ON.
  + Fix crash when using a WebKitWebView widget in an offscreen
    window.
  + Fix several crashes and rendering issues.
  + Changes in version 2.48.3:
  + Fix a crash introduced by the new threaded rendering
    implementation using Skia API.
  + Improve rendering performance by recording layers once and
    replaying every dirty region in different worker threads.
  + Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
  + Fix a reference cycle in webkitmediastreamsrc preventing its
    disposal.
- Increase mem_per_process again to avoid running out of memory.</changelog>
</package>
<package pkgid="677bf4943eca1e2577223e6deba0c46ea7051e153a0b3a0d7347d1d2760b2b7e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="519ac4f28accd5ccf971952f4e91b3074a3efe3a8b6e781ed031a0094c4c1a88" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="2ea4c2dffe3ecf4ef13365f4136f83dc0b38749c6bc643298c61c20c7e9b4cc6" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="7ebc92874f171f5a47e926f02b5ef3b0fdd6bd408003aeb461aa80742f3f260c" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="3cc150d1107dc946ce95436bf3a8040939e1dbc5f215d7cac3e7904f476766cc" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="7312685c5425dc1fd9356785f3538a08bda7bba983535cb0975887d091b7d8f7" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="751350f8e550e426a311865d9dae4402513c941371aa3ace80c5e4484b6acc8a" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="50197db537a413867a295a106284b05d546c432a3b69a4e511d2026e7de3095e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="1b78656f8dfdb2b5b85776c7c80aa1f9bc820009387f71af9936f682fa82b971" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="d2d446e580988df05ed7778dd86e3565bc83d2c2180da61ca1a20af8284a92d1" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="5f1f96c88c301ece2681855fa865d0a08940ab4bd8b2c19c95cdaa9cb1bf7fdf" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="ab2133c248e0b85dae05b3b362926d8b4a632c9cc6a0ee8b9f192dc7ce34292d" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="d20f148941fe0992a91b01eb93a63af542565f4f1dd3cdc58601d6f0edcb5a79" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.5" rel="150600.12.43.1"/>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201,
  CVE-2025-24189.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1754395200">- Update to version 2.48.5 (boo#1247562 boo#1247563 boo#1247564
  boo#1247595 boo#1247596 boo#1247597 boo#1247598 boo#1247599
  boo#1247600):
  + Fix several crashes.
  + Security fixes: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211,
    CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228,
    CVE-2025-43240, CVE-2025-43265, CVE-2025-6558.
  + Changes in version 2.48.4:
  + Improve emoji font selection with USE_SKIA=ON.
  + Improve playback of multimedia streams from blob URLs.
  + Fix the build with USE_SKIA_OPENTYPE_SVG=ON and
    USE_SYSPROF_CAPTURE=ON.
  + Fix the build on LoongArch with USE_SKIA=ON.
  + Fix crash when using a WebKitWebView widget in an offscreen
    window.
  + Fix several crashes and rendering issues.
  + Changes in version 2.48.3:
  + Fix a crash introduced by the new threaded rendering
    implementation using Skia API.
  + Improve rendering performance by recording layers once and
    replaying every dirty region in different worker threads.
  + Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
  + Fix a reference cycle in webkitmediastreamsrc preventing its
    disposal.
- Increase mem_per_process again to avoid running out of memory.</changelog>
</package>
<package pkgid="bd9492cd906dbf1d084580582422926baf8bd3659d4e347b8808635a03439891" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch gi